Some Qs on security/safety/precaution measures about BJv2 thx

hi,

1. Gordon have the same thinking like me that indeed I could get on a train, and use DaFit to brick every other's DaFit smart watches if I wish. There is no security over there. Or even flash a malicious firmware silently?

2. I believe espruino on BJv2 wont be encrypted as full-disk-encryption, as in later e.g. ver 9 of android?

3. thus if I wanna develop something sensitive, like a cipher or password manager, the program it self should be zero-knowledge, until the user feed some keys into it? e.g. a pattern, or a PIN etc. and afterwards, should remove any temp files if necessary?

thanks.