Even the E2EE implementation is garbage. To this day fifty percent of the conversation in every E2EE group chat I'm in is "Hey XYZ I can't see your messages because they fail to decrypt" because they still have bugs in how clients distribute their keys to other clients. Imagine the state of a chat platform literally failing at chat.

Or look at how until a few months ago, the media store of every homeserver served media on the internet without any authentication. Someone just had to post CP in a popular room and they'd get hundreds of servers rehosting it for free. (Recently they finally added the ability to require authentication for the media store, although they didn't add support for it to their web client, only their new Android one.)