Its kind of up to the client implementation.
But as you say, in a compromised scenario we cannot trust relay lists, follows etc of that key.
The client could display all attestation events, with highlights for higher wot keys and follows / follows-of-follows. Arguably more information is better here, the algorithm can be simple or sophisticated.