only "should" pay attention to FHIR Security considerations? Shouldn't this be a requirement?

If an implementation is just FHIR (not SMART on FHIR), does it still need to use SMART Backend Services for security

Existing Wording:

All implementers of FHIR servers and clients should pay attention to FHIR Security considerations
…
… PDMP transactions between the PDMP Requestor and the PDMP Responder need to be secured using the SMART Backend
Services Authorization Guide