(I assume the parent is referring to) those primitives don't provide encryption by default, or offer any options to enable encryption. RFC 7258 considers this a

(I assume the parent is referring to) those primitives don't provide encryption by default, or offer any options to enable encryption. RFC 7258 considers this a vulnerability.