Facebook owns whatsapp and can change the encryption keys at will without the conversation owners knowing.

If "Show security notifications" is enabled in security settings then they'd get caught, so I don't think Facebook is going to start doing that. The address book and metadata they have access to are more useful to them anyway.

except for all the false positives. every time someone gets a new phone in a group chat, someone has to ask "did you change your phone or is someone snooping at you", which creeps them out, because it's off by default, and so we ask less and ignore it, "probably changed their phone".

it's terrible ux for security, it could have been much more transparent and actually encouraging proper security behaviour.

It really grinds my gears when an honest question is downvoted here in HN of all places.

They still collect all the metadata. They know with whom you communicate, and how often. They know with whom you're in a group chat and the names of those groups. They know your profile picture.

(Disclaimer: I'm a bit biased though since I'm affiliated with Threema. I think privacy in day to day communication is very important though, that was my reason for quitting.)

Guessing because Facebook owns WhatsApp now.