Transport and a closed origin
Encrypting the path and verifying who takes part in it are two separate decisions.
The role of encryption, endpoint identity and an origin that only answers through the authorized path.
What TLS protects
TLS establishes an encrypted channel between two endpoints and authenticates the server through certificates. It protects content in transit from reading or alteration by intermediaries outside the authorized connection.
TLS protects the path. Who may use each feature, and whether the received data is valid, remain decisions of the application.
HTTPS must be consistent
Redirecting access to HTTPS prevents navigation from remaining in clear text. HSTS lets the browser remember that a domain must be accessed only through a secure connection for the declared period.
A policy that includes subdomains requires every one of them to answer over valid HTTPS, including those used only by internal tools.
A closed origin reduces alternate paths
An edge architecture has one connection from the visitor to the edge and another from the edge to the origin. Protecting only the first leaves an important segment outside the same level of trust.
When the origin validates the authorized client, finding the server address is not enough to bypass public protection: connections outside the approved path do not reach the application.