[blr_lpm]

For this particular threat vector, where the client is compromised, the backend doesn’t matter.

[franga2000]

A compromised server can inject exfil code into the web page it serves. If you only ever use the apps then you should be fine though.