That's true. Though I guess that when my parent comment referred to "admin", the were referring to the admin for the homeserver (the one routing the messages), which is different from the one hosting of the web client.
This is why services like Matrix and Signal open source their client. Because for security minded people, securing the client is much easier than securing the server.
This is why services like Matrix and Signal open source their client. Because for security minded people, securing the client is much easier than securing the server.