I think it's worth pointing out that even when you install Signal from Apple's App Store, for example, you are trusting that that binary actually corresponds to the open-source code-base in Signal's repository. That is to say, if you can't independently verify what an app store is giving you, then you are inherently trusting that app store with ANY app it is giving you.

But yeah, in addition to WhatsApp not being open-source, it should already be well known not to trust WhatsApp (i.e. Meta) by reputation alone.