Without going into the technical details described by other commenters here, this is my understanding of the problem (please correct me if I'm wrong): You receive the code that is run, from the same entity you should be protecting yourself from -- that being the Cryptocat server. This is a big contradiction.
One really should assume that if a service can be compelled to act against the interests of its users, that will eventually happen.
One really should assume that if a service can be compelled to act against the interests of its users, that will eventually happen.