No end-to-end encryption by default, you have to explicitly start a secret chat. That means that instead of it all being encrypted noise, secret chats stand out.
Servers are not open source (last time I checked). Why not? Seriously, why not?
Admittedly, not much of an issue any more, but in the beginning they had horrible security (so did WhatsApp until Facebook threw some competent engineers at the problem)
Sorry, I don’t talk to liars.