"Still doesn't mean the authentication side is secure though."

It doesn't mean it cannot be made secure, either.