Google's Project Zero team investigated WhatsApp's and Facetime's video conferencing last year:
"Overall, WhatsApp signalling seemed like a promising attack surface, but we did not find any vulnerabilities in it. There were two areas where we were able to extend the attack surface beyond what is used in the basic call flow. First, it was possible to send signalling messages that should only be sent after a call is answered before the call is answered, and they were processed by the receiving device. Second, it was possible for a peer to send voip_options JSON to another device. WhatsApp could reduce the attack surface of signalling by removing these capabilities."
"Using this setup, I was able to fuzz FaceTime calls and reproduce the crashes. I reported three CVEs in FaceTime based on this work."
WhatsApp: https://googleprojectzero.blogspot.com/2018/12/adventures-in...
Facetime: https://googleprojectzero.blogspot.com/2018/12/adventures-in...
In both cases, the close source nature of the applications stymied their efforts. Looks like NSO was willing to spend more time and resources!