The source of truth only matters if you can verify it. You are trusting their relay to do that for you. They can forge posts or even swap out zap addresses this way if they wanted to. if they didn’t want to it could still happen if their relay is hacked. Don’t trust, verify.

I disagree with you, jb55 is totally right if you have a backend you are centralised, you control the data that you fetch from relays and you choose to let users see what's on the relay, but you could easily censor that data if you wanted (or nicely asked by gov)