That's protected cryptographically with key transparency. Anyone can check what the current published keys for a user are, and be sure they get the same value as any other user. Specifically, your wa client checks that these keys are the right key.
No they can't. Key transparency cryptographically makes sure everyone gets the same result.
These are all good measures though. It's much harder for Whatsapp to mass attack users this way.
So for wa to do a man in the middle attack they would also need to convince Cloudflare to sign two inconsistent tree heads.