Yeah like tx related stuff are done through signing which is safe. Sending to any server definitely is bad choice.

But once access token is compromised anyone can post or delete anything using my profile.

Also I am not sure is there a way to revoke the permission for that access and refresh token, because even though after knowing the compromise I might not able to stop the attack.

All our post and interaction are quite valuable which doesn't need tx level security but at par with web2 social like twitter

If @lens plan to make something close to twitter then these are quite crucial points.