Indeed it can't authenticate photons. Security isn't about making things perfectly safe, but to make it harder for the bad guys.