Yet WA defaults to not notifying contacts when keys change. So silent interception is more likely to go unnoticed. And any app could send an automatic update with a backdoor at any moment.

Disassembly and analysis is also harder with binaries than original sources and an open, reproducible build process.

Did they change this? I distinctly remember that after WhatsApp introduced e2e encryption I got a message every time somebody got a new phone. Haven't seen one in a while, though.

That is a fallacy. It's like saying that something is unhackable because it has not been hacked.