If Alby wanted to do so, they could change derekross@getalby.com to point to any LNURL and wallet. I'd never know until it was too late. I'm not saying they will ever do this, but it could absolutely happen. It's just a server config file. A rouge systems administrator could point it to their wallet if they wanted to do so.