Well theres no sensible way to spot between a third party or a first party connection without wasting overhead on the connection setup, so it’s just in the main whisper topic rather than throwing another topic in their or doing a “check whom we send to”.
(Yeah you could check the clientID or the auth code but then you’d want another topic rather than sending different data to different clients on the same topic)