It's one thing to rely on phone numbers for authentication, it's yet another to store the messages. The same scenario on WhatsApp would have given the attacker

It's one thing to rely on phone numbers for authentication, it's yet another to store the messages. The same scenario on WhatsApp would have given the attacker access to the account but not the message history, which is presumably what they were after.