The missing part is often the "well done" part. Other than that - traditional bugs/listening devices, malware (recording the sound before encryption/after decryption)?

Then there's traffic analysis (a talk to b, b kill c, b talk to a). See also: "well done".