The legacy server protocol is only defined as a cleartext protocol.
While #382 deals with replacing the entire protocol with a new REST-based protocol, a shorter term mitigation for any perceived security implications could be to add a TLS layer to the existing protocol.
Support for this would still need to be added to Zino clients as well (it would be hard to add it transparently, since communication with the server can dynamically open secondary ports for notification channels).
Some investigation is needed to find the correct approach.