Comment by ttul

They certainly are. And this is likely to some degree a response to enterprise security desires. Enterprise endpoints are locked down already - no need for extra external API security if it’s just the user’s desktop communication as usual.