2. You are restating my friend's argument, but the idea of E2E is precisely to remove trust from the equation. If applied properly, there's nothing the company controlling the server can do.
3. Most probably, but that's not the point here. My question is specifically about the messages themselves.
4. Sure, but not related to my question either :)
It doesn't do that. You don't have a way to verify what software runs when you send a whatsapp message.
For some reason it reminds me of the famous Moxie article: https://signal.org/blog/the-ecosystem-is-moving Is it the same idea?
You claim that Whatsapp has E2EE, and that eleminates the need to trust them. Well let me ask you something: How do you know they have E2EE? You can't view the source code. Unless it's an open source program, the need to trust Facebook is still there.
And Facebook's history of continously violating user privacy can't be easily dismissed as well. If a company repeatedly collects data without consent, and sell them to third parties, you would be very naive to take them at their word.
Also the fact that Whatsapp was sold for $20 Billion is a huge red flag. Facebook isn't stupid, they wouldn't pay this much money without having a revenue plan.
So as TL;DR: It isn't 100% guaranteed that Whatsapp isn't spying on you, but we got to the point that until Facebook proves beyond doubt that they aren't, it's safe and logical to assume that they are.