The message can't be intercepted in transit, since we are talking about spyware, I assume they get it from the device, hard to defend against that if they have access to your process' memory space.

How is this related?

It’s performative security, when an app still requires a phone number, can’t have your own server, and all these audits are meaningless as you might have memory injected spyware later, it is NOT secure, never was.