Maybe they are. But they would still have non-content timing, location and connection data. That is just as useful as message content.

It can be end to end and Encrypted and still have a backdoor.

I.e keeping a continuous web client active which the user isn't notified about

Even with encryption, WhatsApp could provide users' contact lists, message send time and volume, IP addresses, phone numbers.

Having a phone number is almost same as having person's location and identity. That's why really secure messengers won't require a phone number.

Isn't the fear more about a man-in-the-room attack rather than weaknesses in the e2e?

The end-to-end refers there to the hand-held device, not the peers' brains. The backdoor will then simply be in the hand-held device, intercepting the data meant to be displayed by the WhatsApp application.