I'm fine with paying for it, but what's worse is that the notifications aren't end-to-end encrypted, and the plaintext passes through their server and Google's.

For some use cases where self hosting is required for compliance reasons, this is a deal breaker. And spinning your own mobile apps isn't quite practical.