The vulnerability here is that their application-layer cryptography is vulnerable to adaptive chosen-ciphertext attacks, not that a passive observer could sniff packets and see plaintext.