Mmm. Maybe it's off their mission, but the first thing I expect somebody serious about security to think about is the question: What exactly are we trying to achieve here?

That Tech Solidarity checklist does say who it's for, which is a start, but it doesn't tell them what it's aiming to achieve for them if they follow the advice.

For example, maybe WhatsApp makes the list because it uses the Signal protocol design and they assessed that this was especially resistant to attacks on the confidentiality of individual messages. Or, perhaps they felt WhatsApp would protect a journalist's sources especially well due to the large volume of other WhatsApp users acting as cover for any analysis. Maybe they felt the method users follow to confirm that there's no MITM was better (easier to use, better documented) in WhatsApp than competitors, or maybe they felt its owners were more likely to tell the FBI to fuck off if they turn up with a warrant.