When is it necessary set up S2S Security Token service for an App

I have built both SharePoint hosted and provided hosted apps. One thing I think that is not obvious is when you are required to set up the S2S Security token issuer service (STS) to provide access tokens for authentication.

Am I correct in thinking that this is only really required for on prem provider hosted apps and even with those, when you are using managed code e.g Token.cs?

Therefore you can happily create an Developer Site or even a App catalogue for SharePoint hosted apps and be blissfully unaware of the above prereq ;-)

Daniel