> Few 'bugs' in implementation and you have a nice backdoor.
This holds regardless of whether WhatsApp is a blackbox or not. Now, that doesn't make the claim of end-to-end encryption verifiable, but if you take Facebook's word for it, the bug bounty should be about as good a stalwart as there is against implementation bugs.