From what I read, NSO didn't only hack Whatsapp, they also used vulnerabilities in the Android OS in the media decoder. Given all the CVEs patched on each Android security patch, that wouldn't be surprising.

If that's the case, the articles are focusing too much on WhatsApp failure, but not enough on the failure of the Android OS. To me there is some kind of shared responsibility between the app and the OS here.

Who knows how many CVEs are hiding in the Signal and Riot.im apps? And Riot.im asks for many permission...