Why do you say "everything said on those phones" - did you mean "on this app"? If the backend of an app was compromised, that wouldn't mean the phone itself was rooted?
It is also reasonable to guess that such services have access to malware similar to the infamous Pegasus and a nonzero success rate at deploying it. In short, it's careless to assume none of the phones aren't rooted by a hostile actor.
That's one of several reasons the government has rules requiring that classified conversations take place on specific approved devices which aren't used for anything else.
The compromise is only wrt the admin. Are you claiming the admin itself is compromised? What's the evidence for that?