> He/she is mentioning that an obtained client can always be hacked, no matter what, and the reader of the original comment may not realize that.

That pointless remark misses the whole point. Even though ideally an attack vector would be eliminated, it's already good enough if it becomes unexploitable by the vast majority of potential attackers. That's why there is a whole field called "app hardening" as in a sliding scale instead of "perfect app protection".