Surprisingly Telegram awfully good on that list
Edit: I forgot to add that I found something little of about that report where Signal hash to phone numbers are absent " Which clearly signal store it"! And on Threema FBI still includ it even though it’s optional and 99℅ of the user will not put their number.
They are finding problems like “crime-pizza”:
https://ethz.ch/en/news-and-events/eth-news/news/2021/07/four-cryptographic-vulnerabilities-in-telegram.html
Nothing super serious though so far… depending on your definition though :)