> is considered an anti-pattern now in terms of security.

By whom? It's another layer of security, nobody claimed it should be the sole defense.