New more Secure Auto Routing

2) separating permissions and access control into separately defined filters makes it less clear what permissions are required where because these permissions would live in some entirely different location from the controller methods. I believe that enforcing permissions directly in a controller is more secure, makes it much clearer how access is controlled, and completely eliminates the confusing three-way tangle of routes/filters/controllers, etc.

Yes, it is true.
So relying on filters to implement access control might be a bad idea.

But CI4 already has controller filters and there is no way to set a filter to a controller.
It seems better to have a way to set a filter to a controller.

ci-phpunit-test | CodeIgniter Testing Guide | CodeIgniter 3 to 4 Upgrade Helper