True, but it will still reduce the chance of success to close to zero. If you assume your own users devices are compromised, there is nothing you can do to avoid exposure.