Shifting away from JWTs for sessions is often a response to the risk of replay attacks when secrets are compromised, but it’s worth noting that stateless designs remain valuable for horizontal scaling and low-latency requirements. The real trade-off lies in balancing the inherent security benefits of tokens against the operational complexity of managing centralized session stores.