The real "Whatsapp Backdoor" is that, by default, the app stores a backup of all your messages on "teh cloud". On android, that's google.

So google can play "eve", and every run of the mill script kiddie that can get your google credentials may "restore" your messages. How convenient.

And that's the default settings. So, even if you turn it off, "mallory" can steal the credentials of your contact and snoop into your conversation that way.