You don't know what code they run on their servers, the only way to mitigate this is to run your own coordinator, joinmarket or joinstr are the right solutions.