I think that issue has been patched now and it was only exploitable if you logged in (enter your password) through the website 256 times or something like that. Which most people won’t do, they log in on the app, and maybe once on the website (with cookies saved) and that’s it.
One advantage Mega has is that is has an API for other apps to use. So for example, on Android you can use an app like Foldersync or Megasync to synchronize local folders with Mega (in one or both directions). I think rclone also can connect to Mega. And there’s also a CLI app called MEGAcmd which allows you to access Mega via WebDAV or FTP.