The JWT standard is known to be full of nonsense. Acting like this is some non-issue is hilariously disconnected from reality.