When adding a custom RPC, a notification at the top of the window states:
A malicious Ethereum network provider can lie about the state of the blockchain and record your network activity. Only add custom networks you trust.

Ideally this should be more generic and say: A malicious network provider can lie about the state of the blockchain and record your network activity. Only add custom networks you trust.