How can they guarantee end-to-end encryption when someone could be looking over your shoulder as you type your message?

Same answer. They don’t control the input, they just keep it safe once it’s in transit.