Hard disagree: anything is a target for criminals like the NSO Group; blaming Whatsapp specifically for this muddies the discussion. Sure, you should avoid it - for other reasons, do a proper risk assessment please.
It was. $10M/year. After Apple patched the buffer overflow in the gif lib and introduced blastdoor, they replaced it with Pegasus 2. Apple patched it again. That's why it's sold as a service.