Connect server sharing with multiple teams

I'm planning a new system architecture that will use 1Password Connect and I have a question about the security risks.  Is it fair to say that anyone with root access to the Connect server can access all vaults that server has access to, even if they do not have an access token?  So far I have not see any vulnerabilities without having an access token, but since the REST API is not encrypted, one could easily intercept the tokens using tcpdump.

This question is relevant as we're considering how widely to share the Connect server.  For example, one option is to run a single Connect server for the whole company which has access to all vaults.  Each team would have their own access tokens, limited to specific vaults.  This way, the server can be centrally managed by one team, which might be a more efficient use of time and resources.  But some sensitive users might not accept that risk of their secrets being accessible by the system admin.  So I just wanted to confirm.

I'm curious how other folks run it.  Do you deploy separate servers for each team or business unit? I'm also considering running it locally on each app instance that needs access, so each Connect server would have access to only the specific vault it needs.