> Each time you visit protonmail you re-download (cache can be invalidated) their client

What about their app? They'd have to push a malicious update through the Play Store or Apple's Store to target someone, which is very unlikely.