It would have been more effective to require Meta (and all other messaging companies) to implement an open protocol or open source theirs, so that people can freely write alternative clients free of malware.

A custom API is the only way for a platform to extend its native E2EE sessions and features to other platforms. Making those APIs completely open would become a major spam problem, which would likely end them up in the same situation as SMTP, where small servers are blocked-by-default by big providers.

Interoperability by agreement between legitimate messaging services, using custom APIs is the only realistic and secure way to accomplish this.

The sky might as well rains toads before this happens.

Doesn't Whatsapp already use an open source protocol? https://signal.org/blog/whatsapp-complete/