It seems like the sensitive information is being logged by the app or iOS. The article says that “devices’ encrypted logs” were cracked. That info shouldn’t be logged at all to begin with. There are similar open source apps for peer to peer communication. In an open source app this kind of issue would have been recognised easily. But knowing Apple this was probably an intentional backdoor.