"Thus the client-side code is always distributed by the operator of the web server."

The same goes for client side code distributed by the operators of free "communication services", e.g., Meta (WhatsApp), Signal, etc.

"In other words, web-based "E2E" applications claim to secure against malice on the part of the server operator using encryption implemented in client-side JavaScript, but this is obviously not true, since if the server operator was malicious, they could just push different client-side JavaScript."

Another way to state this is the third party, e.g., the website (server) operator, incorporated as a so-called "tech" company, controls the client software

"It is worth noting that this law also applies to non-web applications where the service provider supposedly being secured against is also the client software distributor; thus, the "end-to-end encryption" offered by WhatsApp and Signal, amongst other proprietary services, is equally bogus. (Both WhatsApp and Signal ban use of third party clients, and enforce this policy.)"

The vociferous advocates of these "services" in online comments simply refuse to acknowledge this issue

"A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against."

"The problem is, of course, that "there's nothing we can do" isn't true. The service provider could develop and ship a backdoored version of the client software."

Auto-updates

The number of online commenters that praise auto-updates, is not small

"There are at least two such cases:"

It's possible a client app could have been "updated" with a backdoor, e.g., for some user(s) in some location for some period of time, and no one would be the wiser

It's not possible to know how many cases of compromise by the third party there have been, whether forced or not

Alt least two, perhaps many more

"Eve: But, just to be sure, take this software. It'll encrypt your communications with Bob so that even we can't see them.

Alice: ...Oh, neat. Thanks!

Alice: ...But hold on... you supplied this software.

Eve: Of course.

Alice: So how does it prevent you from seeing my communications?

Eve: It encrypts everything you send before it reaches us. We can't see a thing!

Alice: But this software auto-updates, right?

Eve: Right.

Alice: So you could update it at any time.

Eve: Right.

Alice: So if you ever wanted to spy on my conversation, what's to stop you from just pushing an update to undermine the encryption?

Eve: Ah... well... you know, that's just paranoid. Why would we ever do that?

Alice: In other words, it can't secure my communications against you in case you turn out to be untrustworthy.

Eve: Well... yes...

Alice: So what exactly is it supposed to be securing against?

Eve: OK, you have to trust us, but what about other people? There's all sorts of people trying to eavesdrop on things. So you have to trust us, good old Eve, but nobody else, at least!"

Is "all sorts of people" referring to Eve's competitors and other Eve adversaries such as Eve's users

Eve doe snot want her competitors to be able to collect the data, perform the same surveillance and provide ad services

Eve does not want users to observe Eve's data collection or Eve's client-server protocol lest they might create their own client software