> if I have a group with 10 users and it's encrypted and then another person joins and can see the old messages, was it actually securely encrypted in the first place?

Sure, why not? Assume, just because it's the first thing that came to mind, that message history is encrypted using GPG and every message is encrypted with everyone's individual public keys. When a new user joins, one user just encrypts the message history with the new user's public key.

Or am I missing something? Do the existing users in the group not have access to their own message history?