Nailed it. Assume your client is compromised and/or malicious regardless of how it was built.