Even Facebook still requires the developers to manually declare things safe/unsafe for 0-RTT, and frankly the requirements for doing this securely are very subtle. This is a massive footgun.