The number of times I have had to remind a developer that the contents of the JWT are readable is nuts. Way too often they want to treat it like a general session store and just toss any old state in there regardless of if the end user should be able to see the value.

The contents of a session cookie are also readable...

I think he's talking about a server-side session store (or perhaps an encrypted cookie payload)