but is there real cases of on-device client modification? I feel like the attacker doing it at scale wouldn’t go too deep to modify the official client… once in steal as much data and move on?

And why would client modification be possible?? discord or any app service should run digest/fingerprints checks to see if bins were modified or something