Neither is necessarily the case. Moreover, even if the client is doing absolutely everything locally, it doesn't mean I as the user have any idea how it works under the hood. There's just as much trust involved either way.

you can run both or use relays you trust. for whatever reason.