I doubt this increase in the attack surface is meaningful. If someone gains control of my device they can in all likelihood initiate a transfer of my files from cloud storage. They can also gain control of the cloud service. But the probability of the latter is too small to consider. When A >> B, A+B =~ A