The core spec leaves usage of the Destination attribute largely up to bindings to define, but the SOAP/PAOS bindings are basically silent on it, and the HTTP bindings put MUST language into their security consideration subsections.

I think we can make it more prominent, and explicitly note that it's unspecified in the SOAP cases (so shouldn't be normatively relied on).