Browsers, operating system and peers can become compromised.
Ultimately users have to be responsible with how and who they connect to. The app otherwise is only as secure and as restricted as any other website. As a web app there are nice features like being able to inspect network activity and code.
A typical mainstream browser can be considered to have been sufficiently reviewed. But you aren’t limited like you would be if the offering was from an app store.