I just read that on iOS apps from the same developer can share sandbox data. That means the facebook app can read the whatsapp message history. [1]

[1] https://www.heise.de/mac-and-i/meldung/Entwickler-Facebook-k...

I think you can pretty easily guess from the #deletefacebook statement of the whatsapp founder that they did not implement the protocol "correctly".

Corporate statements about the security and privacy of their products usually leave open the possibility that they engage in lawful intercept. Even if they don't they can always just lie and use the fact that they have national security letters barring disclosure as legal cover if it ever comes out.

They could probably still use this "design feature" (that Signal doesn't have) to hack users who don't authenticate the people they're talking with (also authentication isn't enabled by default on WhatsApp, but it is on Signal):

https://www.theguardian.com/technology/2017/jan/13/whatsapp-...

If you're a user of WhatsApp, make sure you enable the two-factor authentication PIN, too, because otherwise it should be relatively trivial for your own government to gain access to your account by using your number with the local carrier's help (it's also possible to do it without the carrier's help, given how broken the security of carrier networks is). Many Telegram users were hacked this way by the government in Russia, too.

Whatsapp makes a local backup in internal storage everyday. There is no setting to disable this backup. There are many opportunities to access the chat history, specially for Facebook, that wouldn't require cheating with the signal protocol.

Contact lists and related metadata. Some of it is crucial, like geolocation.