The thing is, it’s not true about any E2E encryption where all parts of the codebase are controlled by the company.

It could be as simple as updating their website to send your password to them in plain text while logging in, now the encryption is useless as they would have your password.