The difference is that you know the provider is willing to ship surveillance-enabling footguns. They don't regard e2ee as core and necessary functionality. Sa

The difference is that you know the provider is willing to ship surveillance-enabling footguns. They don't regard e2ee as core and necessary functionality. Safe and secure providers will never touch the plaintext of any user ever, regardless of the user's configuration (or lack of it). An example (although not in the e2ee sense) is that time Dropbox allowed logins to any account with any password provided. It illustrates that having a basic test suite over authentication systems wasn't important to them.