The app ultimately shows you your decrypted email. If client side code is compromised then I don't think this is the thing you worry about