yes you can verity that it is secure by reverse engineering, just like someone can read the code, someone can reverse engineer it.
And I'm not saying that WhatsApp isn't encrypted, but we can't know if this also applies properly to metadata, or which encryption algorithm is actually used, if the keys are really only accessible to end users (i.e. if it's really E2EE), etc.
It DOESN'T, they literally state that they don't have encrypt metadata and can share it with other meta services
which honestly as long as the messages themselves are encrypted is sadly still a much better option than sms
Of course there's still a level of trust required regarding Signal's operational integrity, as we can't know if this is really what runs on their servers, but at least the Signal Foundation doesn't have a history of countless known privacy violations like Meta does, which means it all comes down to how much you trust either of those organisations
thanks for proving you don't know, even the signal server doesn't know ur contacts...
https://signal.org/blog/private-contact-discovery/
https://support.signal.org/hc/en-us/articles/360007061452-Does-Signal-send-my-number-to-my-contacts
As for the hardware: Assuming that there is indeed some component spying on me, why would this be a justification to become careless about privacy on the software level?
because it'd be above everything else and could see everything, no matter the sw ur using... so it'd be pointless anyways
And it's unlikely for there to be anything on the hardware level that could be spying without anyone noticing, at least if we assume that this hardware would send this data somewhere, which one would surely notice when analysing network traffic or by checking for emitted radio frequencies if the manufacturer had the genius idea of using mesh networks instead.
Just like with whatsapp...