It seems, but I might be wrong (others suggested it though) that you need the app to be compromised to do this. A server hack wouldn’t work because you still ne

It seems, but I might be wrong (others suggested it though) that you need the app to be compromised to do this. A server hack wouldn’t work because you still need your key/seed phrase. The app, with a hack, of course can, next to unlocking your wallets locally, send it to a server (which should never happen) and then the owner of that server can take the funds. To me this seems the most obvious. Use open source wallets, reproducible builds, hashes and, of course, cold wallets. Also, divide; don’t put your money in one place; I would say that goes for banks too.