Yes - esp if you have a sidecar which speaks in-securely to your application. Data theft happens from application issues, or employees with access stealing things - not because of unencrypted traffic in a secure network.