allowInsecure is not a door. In deeplinkmap an http link becomes its own form rather than a universal one, so the host allow-list still refuses foreign hosts, and a route that accepts only universal links stays shut with the flag on. The flag buys you parsing, not acceptance.
Was this useful?