isn't WhatsApp closed source? Aren't users already playing trust me bro with them?

Yes and yes.

My main argument is, or was, that the burden of proof that WhatsApp is not secure should be on the one claiming it’s not.

But now that I have written this out, I’m not so sure anymore. ¯\_(ツ)_/¯