I'd say the issue is that they are aware that the code is human-readable ergo anyone savvy would be able to tamper with and/or spoof the POST data.
I personally would not send any critical data without first encrypting it. I've not been with C2 long enough to reach a stage where I've had to look at encryping data, I did notice in the plugin section there's an MD5 SHA-256 hash plugin. Worst case scenario is you use that to send some check data with each post using hidden data inside your game eg send the data "High Score = 10000 & Username = C2User" the conventional way but to prevent user from fiddling himself to top of high score table send the same data again bu append the hidden data eg the word "banana" and hash it.
On the server end you receive the data but before you enter it on the db you again add the word banana and hash it on the server if both hashes match then insert data.
It's much more complicated than this but unless there's cash or prizes or sensitive data at stake this sort of integrity should suffice assuming the key string is tucked away well enough as don't forget the savvy user could easily lay their hands on the entire source code from C2runtime.JS and even minified could probably work out what's what. Concantenated strings and on the fly variables such as date, user IP etc. make this job much more difficult for the spoofer.