Oh, that got me thinking. At WalletScrutiny we dismiss deeper analysis of custodial products as the custodian has full control, thus it's on him to keep the funds safe but with eCash the custodian almost can't exercise any discretion to protect the user.

Let's say somebody would backdoor some popular eCash client to then trigger a "send all funds to me", what could a mint do about it? nostr:npub12rv5lskctqxxs2c8rf2zlzc7xx3qpvzs3w4etgemauy9thegr43sf485vg have there been any such considerations? Are there mints that would lock funds all of a sudden thousands of IPs would ask to send to the same address? As mints don't send to addresses but to invoices I doubt it would even be possible. The mint would simply detect a sudden surge in activity.

For WalletScrutiny that means that we either can treat eCash as worse than custodial (they can rug you but also cannot protect you against your wallet rugging you) or as "yeah, custodial but popular and vulnerable to both custodian and client, so we better scrutinize the wallets".