My understanding is that the typical architecture for an Ethereum app is to have a smart contract acting as a backend to a centralized, stateless front end which runs on a single server.

Doesn't this pose a rather glaring security risk? If the front end app is hijacked, all of the users' actions can be misdirected to whatever the attacker wants (ie, instead of sending ether to a useful smart contract, it gets sent to the attacker's wallet).

Is there any way to host a front end app in a decentralised way?