It has nothing to do with security, nor specifically with zigbee 3.0.
It's simply a matter of priorities, the vast majority of zigbee touch Link and 3.0 devices follow the more standard approach of unicast reporting their commands to a coordinator when the relevant clusters are bound.
Devices that don't follow along with unicast messaging are going to take a back seat to the more sophisticated engineering involved with those that do.
We will possibly look at this at some point, it's just not a priority right now.
