Which is exactly the issue? At any time the server can request a key reset and have messages resent. I don't see how it is at all irrelevant since it is exactly what the cause is here.
If the client is open source: What the server is doing is irrelevant as long as the client is secure.
If the client is closed source: What the server is doing is irrelevant as long as the client is secure.
If the server can compromise the client, whether or not the client is open source does not matter.
People who believe that open source is a prerequisite for security are disregarding the entire discipline of reverse engineering which is a large chunk of software security expertise.