The initial assumption with these types of services is always that an attacker, having compromised their servers, could simply inject malicious code into the browser.
From their docs:
> Normally, when hackers get access to your server, they can change the code that gets sent to customers. For example, they could make the code say "send your password to us". Then, even though they can't read documents immediately, passwords start coming in and they can soon read them.
> To solve this, we're using a relatively new web technology (Service Workers) to install some code which can't be changed without setting off a warning to you. That code then keeps taps on all other code, and checks that it matches the publicly available version on GitHub.
Interested to see how robust it is...