I've been running my mobile app for 2+ years and never bothered supporting webhooks. It hasn't been an issue yet. Nefarious users can deconstruct my app to by-

I've been running my mobile app for 2+ years and never bothered supporting webhooks. It hasn't been an issue yet. Nefarious users can deconstruct my app to by-pass payments, but the juice to support them isn't worth the squeeze. If someone is willing to go through that much effort, they must really want to use my app and I will let them enjoy their prize :)