Unfortunately there's platform-level features for marking surfaces as sensitive/secure. So your dev would typically just mark the whole app as such, and be proud of their proactive problem solving.