The current version does not require a login and build was verified and signed by apple as malware free. Future versions will likely demand the posting key only - so your funds are proven to be secure.
The code is open source on github. See @abit comment below, a process for verifiable builds needs to be established. Track progress here: https://github.com/riensen/steem-app/issues/1