The Facebook-owned company has end-to-end encryption by default\u2014but that doesn't mean the service\u2019s settings are as private as they could be.