Not saying they have to be, it's just a weird assumption that I've built up in my head. Possibly because obsidian handles sensitive data and I somewhat was under the impression it has the open-source tier scrutiny when it came to inner workings of the app.