Presumably they'll have to sort out what kind of performance hit it has and how to address that longterm, but I think you're correct.

It's probably more complicated than that given that the Redis security page begins with:

> Redis is designed to be accessed by trusted clients inside trusted environments.

https://redis.io/topics/security

I think the current recommended approach for this use case is to wrap it with stunnel.