Yes, it is a false sense of security, but in this case it is static content being served. This should not be used in eCommerce sites.