Comment by freeplay

Nailed it. Assume your client is compromised and/or malicious regardless of how it was built.