Nobody capable of finding exploitable issues is going to be deterred by being an app rather than a website.

If their thought process on this is actually “security through obscurity”, then I would not go anywhere near this as it tells me immediately that they don’t give a single solitary fuck about proper security guidelines.