All security models assume an attacker controls the network. The only protection is strong encryption attackers cannot break it. If data is unencrypted, it should be considered compromised.