We have recently used a security scanning tool to assess security of an application.  It raised a particular configuration as a Medium vulnerability.  The claims made in the explanation of the discovered vulnerability don't seem to match with industry standards.

The claim is that "transport mode" security is insecure:

> "Transport mode is the least secure option and should be avoided."

This quote above comes from this article relating to WCF security:   
https://vulncat.hpefod.com/en/detail?id=desc.semantic.dotnet.wcf_misconfiguration_transport_security_enabled#C%23%2fVB.NET%2fASP.NET

The claim here made by HP *appears* to be that transport layer security, including SSL and TLS, is *less secure* than message-based security.  The article further explicitly states that TLS is *susceptible* to man-in-the-middle (MITM) attack.

Further research into MITM attacks seems to indicate that the **opposite** is true:  TLS is the *preferred* way to *prevent* MITM attack.  Resources supporting TLS include:  

https://en.wikipedia.org/wiki/Man-in-the-middle_attack  

http://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication/477578#477578

http://security.stackexchange.com/questions/26142/do-client-certificates-provide-protection-against-mitm

So, the question is:  
**Is there any merit in the claim, by the HP article, that transport-mode security is to be avoided, for the reasons cited in that article?**