That's not the case at all. The security here is more like HTTPS/TLS with the client not really being validated (just the server). The encryption remains just as strong as if the peers we're locked down.

It's different than the VPN use case where you absolutely want to lock down access to known peers.