add comments / clarifications / renames wrt direct tab messaging security

[tomholub]

mostly comments and security clarifications, so we don't leave footguns around

Originally posted by @tomholub in #5320 (review)