Yeah I hope most didn't either, but I feel like even those who did didn't assume they stored the nsecs on a server, there's plenty of ways you could login with an nsecs but not store it.