For What'sApp the attack is apparently even more simple. IIUC, there is a client-side whitelist of MIME types on uploader's side. Obviously, the attacker can change the code on their side to whatever they want; in this case they just add text/html to the whitelist.

Apparently, the receiving end just uses the browser to render whatever it's being sent. So apparently there is (or was) effectively no whitelist or verification on the receiving end. Conveniently, the uploader can also control metadata including filename and the thumbnail.

Since the payload is e2e encrypted (for What'sApp, anyway), the server obviously has no idea that any of this is going.

it's very easy to say "wow they should have tested for that" in retrospect with any vulnerability

Definitely, which is why I said: any security audit would have found this, so I'm guessing they never had any.