client side scanning.

Whatsapp is closed source, and could implement a switch that can be remotely enabled by them that makes your client to start scanning your messages + upload plain text messages to their server in case it reveal some particular words.

Just a possible example of a backdoor well obfuscated in binary release that doesnt deal with crypto. This backdoor with open source and reproducible builds would be pretty impossible, but with closed source complex apps it is realistic and possible at least...