To me this is the hilarious part. Q: "how do they use the workarounds needed to secure the more complex approaches?" A: "those security concerns don't exist i

To me this is the hilarious part. Q: "how do they use the workarounds needed to secure the more complex approaches?" A: "those security concerns don't exist in the approach, no workaround needed. That's part of the simplicity". It just represents a fundamental misunderstanding, but it's not their fault, they've never seen anything else. Like someone using a JWT instead of a session cookie.