Single Packet Authorization doesn't claim to do anything about encryption, authentication, integrity, auditing, or anything else.

Leave ambiguous terminology hair-splitting at the door and get to specifics.

It's securing the keyhole of the padlock. No sense moving the padlock around when it can be closed to begin-with, and opened with a special knock that is extremely complicated: time, service, and identifies which user.

Port knocking on top of VPN, SSL, SSH, Wireguard, or whatever. You don't do this with telnet because common sense. Duh!