I think the article addresses the first concern: the radio connection is encrypted with the AES key in the QR code that is scanned optically. As for the second, if they are in the device, you're already screwed: they might as well intercept the keyboard/camera/mic instead of hacking the app. Same for hardware access.