If you're worried about encryption, though, you wouldn't be using their app to display the pushed messages, you'd be using something you control; you only use their push infrastructure as infrastructure.

Think of it like email: Email is not inherently secure, but there is nothing to stop you sending an encrypted message via email.

So in this case you would push an encrypted message, and your app would decrypt the message before displaying its contents.