Wouldn't a server compromise allow someone to "lie" to the web client only, while continuing to give correct answers to the standalone client? Seems like that

Wouldn't a server compromise allow someone to "lie" to the web client only, while continuing to give correct answers to the standalone client? Seems like that would be very difficult to catch. (or, just hack the web client so it lies, independent of what it actually sees from the server) Server compromise wouldn't even need to take place on the server itself.