of course, nothing magically prevents the app from sending keys or decrypted content to a third party.
That's why if you're really serious about e2ee you have to install the app from source.