Steps to reproduce

1. Ensure that you have enabled exclude insecure device from alice EX client
2. Use a second bob user, and login a web session and skip verification to make the device insecure.
3. As bob, from the insecure device, send a DM to alice.

Outcome

What did you expect?

The message is sent from an insecure device, so it should not decrypt on Alice side.

What happened instead?

I can see the content in the notification. The timeline is correctly ignoring the message

Your phone model

iPhone XR

Operating system version

No response

Application version

No response

Homeserver

matrix.org

Will you send logs?

No