I don't like webui's for lemmy. This means they're getting all your traffic. It's a mitm situation again, much like google's amp links.
If I'm running a dedicated app, I can validate that my traffic is going directly to my instance and not being farmed and sold by a 3rd party behind the scenes.
Uhh.. not clear on what you're claiming here... you can validate the traffic is going to the expected instance using a web app, without requiring any special software by running Developer tools and heading to the network tab.
Web front ends currently require a backend service that then routes to your intended destination because Lemmy servers by default are configured with cors to only allow requests from their intended domain. There is a PR to fix it but I don't believe it's been merged in. This may be out of date but that was true as of a few weeks ago per the dev of Voyager which is the web frontend I use
edit: this is no longer true. A PR 2 weeks ago fixed this issue and web front ends are able to work just as well as a native app now.
1.) Turns out this is no longer true because the cors issue is fixed as of two weeks ago.
But to answer your question:
Well that's the really silly part about it. You see, the way CORS works is that it only works if the client making the request implements cors. In this case when I say client I'm talking about your web browser itself. Native applications, or hitting an API directly via network calls, don't implement cors and thus you can make the calls all you want and the server responds. So even when cors was configured to only allow requests from the correct domain it only affected people with web browsers.
However two weeks ago a PR was merged into the Lemmy source code setting the cors to by default allow requests from anyone instead of a specific domain.
That checks it only for the current session, though. The app might do nefarious things only on new moons, or on a specific date. It might also get updated at any point with completely new code without you noticing.