Yeah, you have to trust the app. The point is that they don’t have to do anything nefarious in their app, because there already is a gaping hole in the system.