SSL Termination

Your load balancer is configured to terminate TLS — it accepts HTTPS from clients and forwards plain HTTP to backend servers on the internal network.

A security-conscious teammate raises a concern: "Internal traffic is now unencrypted — this is insecure." How do you respond? Under what conditions would you consider end-to-end TLS (re-encrypting to backends)?