What matters most is that the open-source gets audited and only posting WIF passphrase gets used in the app. 

As long as the Active or Owner keys aren't entered, I can't imagine any major risk. 

Being able to build on top of the Steem blockchain _without permission_ is a huge value proposition for the ecosystem.