Client data absolutely is encrypted in TLS. You might be thinking of a few fields sent in the clear, like SNI, but generally, it’s all encrypted.
Asymmetric crypto is used to encrypt a symmetric key, which is used for encrypting everything else (for the performance reasons you mentioned). As long as that key was transferred securely and uses a good mode like CBC, an attacker ain’t messing with what’s in there.
I think you’re confusing the limitations of each building block with how they’re actually implemented together in TLS. The whole suite together is what matters for this thread.
I once got into it with a dev who had written an Arduino library. I reported a compile bug, and he said my environment must be broken. In fact, it was because the headers in the library were set for
#include 'arduino.h'
, notArduino.h
. Which would work fine on the default settings for Windows and Mac, but not Linux.