My point is that using SSL on its own as the only line of defense should not be an excuse not to have anything else.
It's like saying my apartment doesn't have a spec for a security system nor a safe because the lock on the door does enough of a job to secure it.
Also, a widely studied protocol spec means nothing. The bugs are from the humans coding the implementations, it doesn't matter what level it is, they will have some bugs. Nobody can code a perfect secure implementation but we can have some kind of redundancies in the system, where if one security level fails, the rest can still have some reasonable security left.
Relying on SSL alone is not enough. But I don't think JMAP is the right place to do this, we may need something else in addition to JMAP.
At least JMAP is extendable, so that's one good thing it has.