You are correct. Fortunately, or unfortunately depending on your perspective.
Filed under: Oh well, security is certainly more important. The recent update rocks, so we'll take it even if we don't get "back button" back.
For those of us using IWP extensively, then you know that almost every single client (and every new user) hits the back button or keypress, and you have to add to your instructions and pound into their heads that this will not work. For one of our clients who is large enough to have at least a few new users every month, we still get complaints after 10 years of the solution in the field. It was one of our "finally resolved" bullet points in switching to WebDirect.
Pre WD update the back button was smart enough to skip screens that may have been a passing part of a script, for instance landing on a layout to gather field IDs would not be part of the back-button list. It worked beautifully and with good security for all tests we conducted.