Yes, Area 51 isn't really secure yet.
This is a really high level list, there are a crazy number of nuances and edge cases to the above. This is for Q&A. Area 51, Chat, and stackexchange.com (the main site) have a separate set of concerns and code we'll address after Q&A. The list also isn't necessarily in order. While we're testing #6, Samo and I will be working on #11 at the same time.
And discussions was apparently causing problems:
The only such special casing in place now is https://area51.meta.stackexchange.com/, which is already a massive pain and tech debt factor. In fact, it's causing pain with the HTTPS move right now, since I can't move it the same way as everything else.
See also this post on Meta.SE.