Why does Kafka broker-to-client communication need TLS encryption in production, beyond just 'security best practice'?

Without TLS, both the message payloads AND consumer group / topic metadata travel in plaintext across the network — anyone with network access between the client and broker could read message contents (potentially sensitive business data) or credentials used for SASL authentication, which is a real, exploitable risk on any shared or cloud network.