The passwords might be encrypted. But an attacker could make a small modification to JS code, or push a bad application update to everyone. Both website and t

The passwords might be encrypted. But an attacker could make a small modification to JS code, or push a bad application update to everyone. Both website and the Apps can be compromised. This is actually how governments broke E2E-encrypted chat systems of criminals: by taking over the central server and from there updating everyone.