Access to Xpra’s sessions over TCP, websocket and unix domain sockets (see network) can be protected using authentication modules but those do not protect the network connection itself from man in the middle attacks.
For that, you need to use one of these three options:
QUIC connections must use TLS.
See also: Security Considerations