In fairness, this is only the case when people are actually inspecting the code. That safe could be a cake that looks like a safe, but if nobody tastes it there is no real benefit (in terms of security at least)

Just a shame their android app needs play services for notifications, even though Element upstream does not