I am not surprised. I also roughly remember their CJ client implementation smelled off for potection against an adversarial server, and unrelated to that I believe the UX did not allow users to switch the backend node implementation *before* setting up a wallet.