The client is another story, but for the server they forked ejabberd which is a reliable, established XMPP server. So they probably had "fast-cheap-secure" on the server-side, because 6 years had been spent ironing out ejabberd bugs before the first version of Whatsapp came out.

My understanding is that vulns in Whatsapp so far were client-side, but i'm interested if i missed some on the server side.