This is exactly correct. Security teams at our clients routinely "flunk" applications because they fail to set the "Secure" flag on cookies; this flaw is even worse than that one.