Week 13 Muddiest Point

My question is about the Shibboleth AA Process - the concept sounds ideal, but doesn't all that checking and routing back and forth also have security concerns, as well as potential overload of the network resources involved?