Push notifications for e2e messaging apps carry e2e encrypted payload, which can’t be decrypted unless Apple reads the private keys from those apps sandboxes…
Then there are all the ways, both white and varying shades of gray, of installing software in the end devices. That's your primary threat right there.