It's easier to just chown the app to a user different than the one running it (so it can't self-modify) than it is to set env vars for GUI apps in macOS.

I run a fork of the client now anyway, and bitwarden_rs on the server. I didn't want to deal with it but the dev responses to security reports are terrible.