The same thing happens when the data is serialised into HTML rather than JSON. Sensitive primary keys get encoded in weird places, like element IDs or class names, even in embedded JS within the page.

"Not as visible" depends on who is looking.