The product team confirmed with me that the communications for connected apps are all encrypted. It's not mentioned in the docs, but they will add it and have created a tracking item to do so.
Thanks for pointing this out and happy holidays!
Marilee