Yes. This is essentially a binary with the browser acting as the OS. And if it's hosted on a server it's a binary which may change at any moment. There isn't even a mechanism by which to freeze its hash and alert you if it changes - a browser would have to provide that functionality.

To be fair, the exact same problem afflicts something like Protonmail, so calling it a toy may be too harsh.