The whole writeup seems like missing the forest for the trees - Google as root access on the Android device where this app runs, so they can certainly see everything if they want ....
In contrast, subpoena'ing data from the cloud is routine for police in countries all over the world.
For example, in the past I've worked with an AI company with presence in China, where the data of their Chinese clientele must be stored on a separate data centre operated by a local enterprise.
Despite the provider being ISO compliant and holds internationally recognised certs, is there realistically a chance that those data could be accessed without the permission or consent of the users?
Under this model, if Google gets a court order to root-break a specific phone (push malicious update), they will be forced to, and that's all the legal framework necessary, so end-to-end encryption doesn't protect you in this case either.
"secure as practically possible" depends a lot on what practically means, and that is just a function of cost vs threat level. If you believe that Google will access your private data, you should not be using a Google-developed application and OS in the first place.
Everyone also might have "google play protect" enabled on their phones which allow google to pack and ship all and every app at regular intervals (no mention anywhere if it include user data) to their servers for threat analysis.