It's true, so we plan to add option to rollback donations that was not withdrawn for some significant time (like several months). The other and more trueish way is to integrate owner verification inside a local wallet, but it's much more difficult than delegate to a webservice.