https://github.com/kubernetes/community/blob/master/wg-security-audit/findings/Kubernetes%20Final%20Report.pdf

search for:
Superficial health check provide false sense of safety
Finding ID: TOB-K8S-009

the TL;DR is that the document argues that our health check only checks API server and should check the rest of the CP components too.