[mahyarm]

I think companies start addressing things like security more seriously when they start becoming 'comfortable' companies. Which means securely profitable. Security is higher on the pavlov pyramid of software company needs than 'is a viable business'. I doubt WhatsApp is securely profitable, or flip a switch profitable like amazon.com.

When you are not viable as a business new features or begrudgingly addressing the huge amount of technical debt you generated in your early days so you can deliver new features faster is what you focus on. WhatsApp will only address security when it threatens the viability of their business, which by that time will probably be too late.