The most interesting vulnerability is the reuse of cryptographic keys, some of it apparently by design, like when transferring one's account to a new number - this can apparently be used to correlate identities despite the change of phone number.

Also, from examining the published data set I found it interesting that there are only five WhatsApp users registered in North Korea. I wonder who they are.

The lack of rate limiting was surprising.