Does MITM on the attacker's device really increase the complexity? Setting up one of the http debugging proxies isn't that hard, all you need to do is modify a response body from a http request. ive done this plenty with charles to hack the loaded save state from games with no server side validation