When the source code has a whitelist of usernames for which encryption should be disabled, put there under court order, you'll see the difference between external verification vs source code inspection.
Obviously, a WhatsApp backdoor would not in fact take that form.