"[Secure NTP] But that's what NTP should have been, 15 years ago—it just allows the network to be untrusted. We aim higher these days"..... So the infra/servers cannot be trusted.. THIS is the real takeaway.
Do you currently trust your LAN?
Do you not currently have some level of trust with pool.ntp.org or your OS hosted ntp mirrors?