I think their point is that E2EE’s protection starts at one end, and ends at the other, and the ends themselves are not particularly trustable