I still don't understand the note that the companies can't decrypt the messages with e2e encryption. Isn't it as simple as a software update that says:

"If user = foo, then send the on device keys elsewhere"?

Or if those keys are part of a TPM, then a software update that just asks it to send in the decrypted messages?

Can judges not order this now, but can order decryption if the keys are stored centrally?

of course, nothing magically prevents the app from sending keys or decrypted content to a third party.

That's why if you're really serious about e2ee you have to install the app from source.