> You do have to trust the company that it will never send the password or plaintext data back to the server. Checking this on a continuous basis is essentially impossible

This is why I like decentralized apps where you can use a content-addressed frontend that is just pinned to a specific version. I can choose to update to the next major version if I want to.