Sure, WhatsApp could roll out an update that sneakily exfiltrates your local encryption keys and/or messages any day, or might have already done so. That's the case for most apps (yes, even open source ones, since at least the Apple App Store does not allow for deterministic builds.)

It's theoretically possible to improve on that, by e.g. providing a way to double-check all client-to-server communication, but that's extremely difficult to do without at the same time weakening the encryption (since it requires either deterministic encryption and/or leaking keys via a debugging interface). I believe Threema has done something like that at some point.

Telegram however wouldn't even need to, since practically all messages are already available to them server side.

Or the vendor of your smartphone.