If you're worried about encryption, though, you wouldn't be using their app to display the pushed messages, you'd be using something you control; you only use their push infrastructure as infrastructure.

or just open source

There is still no "compile code, install app, and throw this process on a VPS" solution for pushes, from what I recall

Think of it like email: Email is not inherently secure, but there is nothing to stop you sending an encrypted message via email.

So in this case you would push an encrypted message, and your app would decrypt the message before displaying its contents.