It depends how it’s implemented. If they implement correctly, then you’re right. But not all do. That’s a fact that bit me in the arse once, and I no longer use those features for lack of trust.