From a purely opsec standpoint, it doesn't really matter whether the backend is open source or not. Either way you can't know what kind of data is being shared and whether metadata is being deleted or not. What actually matters is that the client is open source and thoroughly reviewed by independent 3rd parties. With a good messaging app, it shouldn't matter what runs on the server. And it is known that Telegram's client uses some weird in-house crypto and doesn't encrypt chats by default.

This is why I'm not going to ditch Threema, even though its backend isn't open source. I think they have a solid business model, which is why I support them. I still prefer Signal though.