It's true, so we plan to add option to rollback donations that was not withdrawn for some significant time (like several months).
The other and more trueish way is to integrate owner verification inside a local wallet, but it's much more difficult than delegate to a webservice.