Which is why you should only trust things with E2E encryption.
How do you know they really run end to end encryption and are not lying.
Because that’s auditable on the client end. No need for trust.
You can trust open source, because it is transparent. You can verify, so you can trust. Perhaps it's time to start rolling back the layers of secrecy. Sunshine is and always will be the best disinfectant.
Unless you run it yourself you don't know. They could run a modified version ect. You can't know and at some level you have to trust that they do what they say.