[jeroenhd]

They are if you enable encryption (with your own key, of course). The default backups are insecure, though.

[mulmen]

Except you provide the key to the app and the app is controlled by FB. There’s really no way to prove the key stays on your device. Or that your messages aren’t just forwarded without encryption to a FB datacenter.