I agree completely, I recently went thru this. Customer API session/journey security is a beast to secure, so many layers, so many moving parts, so many approaches.