sounds like you think using Aqua on iOS is a significant risk. If I understand you correctly, what are the threat vectors?

Assume friend uses the Aqua app while on a data VPN such as a BTC-paid anon ProtonVPN account with secure recovery email and self-custody of email storage keys.