You are trusting the domain that hosts your lightning address. Even if it's domain you own, it can be seized...