I wouldn't make that assumption; adding TLS or HTTP on top adds more work and processing power, and if good-enough encryption was promised by the use of GSM/GPR

I wouldn't make that assumption; adding TLS or HTTP on top adds more work and processing power, and if good-enough encryption was promised by the use of GSM/GPRS, why would they add it on top? That's like adding custom encryption on top of HTTPS... which isn't unheard of actually, I knew someone who built that for a banking app, and an ethical hacker got through the HTTPS layer pretty fast.