Hard disagree: anything is a target for criminals like the NSO Group; blaming Whatsapp specifically for this muddies the discussion. Sure, you should avoid it - for other reasons, do a proper risk assessment please.
It was. $10M/year. After Apple patched the buffer overflow in the gif lib and introduced blastdoor, they replaced it with Pegasus 2. Apple patched it again. That's why it's sold as a service.
And it's sold as a service to nation-states. People who should be taking measures for this to never happen again are, one can say, culturally sympathetic to those buying it.