What lies?
You can try app.mutinywallet.com in the web browser on that phone.
you literally pointed to use Mutiny onto a domain the user can't control it. is that a lie? Any time that domain could be shut down or even worse, you close the access. I can't name that self-custodial, even that keys are in my device.
Do you trust an Android 5 security keeping Mutiny keys? Running his own domain, LDK node and Mutiny server for that user that barely have an old device with Android 5 is not an option. Is that also a lie?