How do you sign up without a phone number?

From what I read, NSO didn't only hack Whatsapp, they also used vulnerabilities in the Android OS in the media decoder. Given all the CVEs patched on each Android security patch, that wouldn't be surprising.

If that's the case, the articles are focusing too much on WhatsApp failure, but not enough on the failure of the Android OS. To me there is some kind of shared responsibility between the app and the OS here.

Who knows how many CVEs are hiding in the Signal and Riot.im apps? And Riot.im asks for many permission...

Or Briar or Ricochet, or something developed in house. Honestly, the thing that's so perplexing to me is why so many people in these roles would be using Whatsapp at all for these things. It's like SoS mentality (to use an imperfect metaphor) run amok.