That’s different. That’s not what I mean by your messages being “stored on a server”. What you’re talking about is an incremental backup sync. It’s not where messages are fetched when you receive messages while chatting. Not to mention it’s entirely optional last time I checked. I have it disabled and it doesn’t nag me about it. 🤷‍♂️

This "incremental backup" is literally the same thing that's sitting on your phone and from where the messages are read from and where new messages are appended to. So it's technically is being read from there, e.g. if you receive a message, uninstall whatsapp before opening reading it, re-install and restore from backup, you've technically got a message from google's server. Secure messengers are not space magic, it's just a database, probably even just JSON file encrypted with some homebrewn public key crypto derived from a seed phrase. The only difference between WA and other messengers is that Facebook is for some reason very adamant about keeping it at your phone, and also shifts the burden of storing messages to google rather than themselves for some reason.

The whole security aspect is surely an issue regardless of app, if the perpetrator is looking to steal your data rather than your hardware. If they have your phone, and bypass the lock screen, then they have your 2FA app and everything. You’re fucked regardless of app.

Nope. I can literally hand you my unlocked phone and you wouldn't be able to do anything malicious with it because everything is behind passwords, passkeys, and fingerprint verifications. Last one, not a big fan of, but it's the only option for some of the apps. You can try some advanced techniques like memory dumping and scavenging keys from there, but if you're too slow and/or I get to any other device first (even not mine), then there wouldn't be anything to recover from it at all.