Messaging apps these days are a huge vector for attacks since they have these massive, sprawling featuresets and are often integrated deeply into the OS. You've got rich text, URL previews, audio, video, automatic message parsing for replies/calendar events/reminders/2FA codes/etc, emoji, stickers, GIFs from external services, the list goes on. Most of the time there's some level of separation for third party apps like facebook messenger and discord, but the built-in apps are much closer to the OS and often have expanded privileges.
Messaging apps these days are a huge vector for attacks since they have these massive, sprawling featuresets and are often integrated deeply into the OS. You've got rich text, URL previews, audio, video, automatic message parsing for replies/calendar events/reminders/2FA codes/etc, emoji, stickers, GIFs from external services, the list goes on. Most of the time there's some level of separation for third party apps like facebook messenger and discord, but the built-in apps are much closer to the OS and often have expanded privileges.