Or, you can trust that a position in a book (bookmarks, notes, etc.) is not sensitive information that really needs to be encrypted. This is my - perhaps overly pragmatic - position.

Yeah, it's not like Amazon can afford security experts to work on this or anything.

>Or, you can trust that a position in a book (bookmarks, notes, etc.) is not sensitive information that really needs to be encrypted.

This is an ignorant position that has been proven wrong over, and over, and over again. Private data should be secure by default, because otherwise eventually someone will figure out how to abuse it. This is a lesson form bazillion fraud schemes and social engineering hacks everyone in tech should have learned by now.

If all data is secured by default, then the identification of PII is not about deciding to secure that data, it is about identifying where we might impose (and often this isn't required, but now we can consider it) additional UX burden or complexity in order to add _additional_ security.