Explain the idea of JWT as the session value, and how it is more secure to conventional JWT?

[larsqa]

I've been playing around with NextAuth and use it in a oAuth setup.

Now that I have a basic overview of the package, I'm curious but also intrigued as to why you decided to use a JWT token, fill it with data, encrypt it (JWE), and store it as the value of the HttpOnly, next-auth.session-token cookie.

Meanwhile, when using getSession, NextAuth makes a request to www.example.com/api/auth/session, which returns the value of the HttpOnly cookie.

A. Unless I misunderstood something after digging through the source code, NextAuth doesn't actually use session when session.strategy is set to jwt? Why then use the term "session" (confusion) at all?

B. How is this then different, and more secure, than to using normal JWT? The client may now not read the content of the JWT any more, HttpOnly may prevent now basic XSS attacks, but what about the rest? As soon as someone has gained access to the JWE, it's over.
According to the documentation, CSRF tokens are only used during Sign In/Out.

I appreciate anyone's time who could help me understand NextAuth better, even if it's only by helping with one of the above points. :)