> Not using encryption properly?
They didn't mean that, they meant siphoning off data client side, for reasons, like CSAM.
The point, which I agree with, is having to trust a single closed source implementation of a client is not so different to trusting the servers of a non E2E service.