Don’t think this merits an “actually” - using a session key et al. is basic usage and does not bear on the strength of RSA itself.