> Break one key, and all messages will be accessible to an attacker.

How do you propose breaking that one key, though? The attacker also needs to somehow acquire access to the key backup and to the encrypted messages, so it's a multi-step process.

The encryption protocol does rotate message keys. In fact it uses the same cryptographic primitives as Signal, that is the double ratchet algorithm.

I think you're conflating the message encryption protocol with cold storage, which is the purpose the key backup serves. It's completely typical for backups to be encrypted with a single symmetric key.

Finally, the key backup is completely optional and can be disabled.

Then, how do you break the key?

Brute force? If you break one key that way, it's likely you could break equally secure keys as well.

Access to the device? Well then you have access to everything anyways