The app's always connected to the network. There are many attack vectors which cannot be predicted. Vulnerable dependencies are only one of them, we should try to see the bigger picture.