It can only deal in tokens, so you're essentially right that it creates a textual description before describing it back to you. This process is obviously incredibly lossy and details are easily missed
Most requests are reads and letting someone use an invalidated session for reads for 30 seconds on a shortlived token isn't the end of the world, especially considering that the exact invalidation timing and its propagation is already somewhat arbitrary.
For rarer privileged actions you can check a token revocation list.
It takes considerable energy to train models and run inference. You can't dismiss AI generated content as "low effort", but you can dismiss it as a wasteful diversion.