But a MITM should still be visible
More details?
https://www.aljazeera.com/news/2021/1/26/iran-blocks-signal-...
Q: Why would Iran block Signal but not WhatsApp if they actually use the exact same protocol? A: Because Facebook has cut a deal with the regime to give them access to things they could not get access to with Signal
I suppose it could be that blocking WhatsApp would cause too much disruption, so the Iranian regime tolerates it for now, but I put much more weight on Facebook just rolling over.
There are other instances of WhatsApp being allowed and other allegedly as-secure platforms being banned. It could be chance or network effects, but my guess is that Facebook has built in tools to comply with those regimes' spying demands. Perhaps they even push locale-specific versions of the app.
It’s probably done on the device, with suspicious links and media sent to the servers for further inspection.
We are also sure some of their engineers worked on methods to detect bypasses on the checks.
It’s a leak of data and metadata, a privacy invasion for sure, but not comparable to a MITM.