groups is weird, the media have the index encrypted but the contents use a shared app key.

commercial accounts are also odd. it's encrypted with the business and whatsapp keys, so employees from both can read the messages.

then here there's the api issues. you are not using a full client, but sending your access token plus the plain text message for it to be encrypted on their servers.

even worse, in this example it's not even you using the api, but you are using twillo's api, who then uses metabook's api for whatsbook. so it's plain text all the way across those.