Messages probably are, the app itself may have openings that allow an attacker to see messages. In the early days of android, it was also possible to have a r

Messages probably are, the app itself may have openings that allow an attacker to see messages. In the early days of android, it was also possible to have a rogue google update service on a wifi AP, so when android connected to it you could push an update with malware.