> (Even though the worst a malicious server could do is delete your database).

Unless you use the web client, and a lot of Bitwarden's functionality is only available via its web client (including critical functionality like changing your master password).