That distinction matters: a device being added to an account can bypass the cryptography without breaking it. It also makes endpoint integrity and clear user-visible session/device auditing just as important as the cipher suite.