> One that I'm sure many of us would have considered if we were implementing it, things like this do get missed too of course, but enough eyes on the design could have caught this.

It wasn't a design flaw, it was an insecure-direct-object-reference implementation flaw. IDORs are extremely common, but since the group id is an unguessable 128 bits, the bug can only be used by someone who was already in the group previously to rejoin the group. I'm sure it'll get patched shortly, if it hasn't been already.

For the WhatsApp case, a malicious WhatsApp server could add someone to your group, but everyone in the group would see it.

These bugs are not big deals. The real harm comes from regular people reading articles like the Wired one or the famously wrong Guardian one and switching to much worse alternatives, like SMS or Telegram.