In the headers, yes. But you can still put whatever you want in the response body alongside that 404 code in the header

They can still send bodies, which is where GP said the message should be.