I think the idea is that if you use the official client, there is “no risk” because everything is encrypted client side anyway.

In theory.