Yes, there are many ways it could be done. However, I doubt that a private company whose business model was end to end encryption would secretly bake a back do

Yes, there are many ways it could be done. However, I doubt that a private company whose business model was end to end encryption would secretly bake a back door into every client by default. Any exposure of this by reverse engineering or whistle blowing would end the business. Why would a private company work against their own interests in that way? I could imagine that specific clients got special back doored versions under some kind of secret court order, but I'm not sure what the delivery mechanism would be for that. Edit: your final point that you could compromise a device independently of the app itself seems much more likely to me. Tools to do this exist and have been provided to governments.