You’re right and I agree with you, but as to point 1, they don’t really act like a proper open source project and it seems more like a “source dump” than anything. It’s hard to compile on your own and they don’t like forks connecting to official servers either.
That, and "just go contribute" is really just a cop out answer. Users can desire features without it requiring that they learn to develop software. And really, does anyone want brand new, fresh developers contributing to a privacy-oriented product? Of course not. We need experienced and skilled developers to do that, because mistakes can be costly.
To be fair he was talking about usability and not encryption/privacy features. I agree mostly though, even capable developers don't have time. Feature requests make software better. If you want people to use your app, you should build for the user. It seems they want people to actually use it and didn't open source just to share knowledge of the code. They probably open sourced it to inspire trust.
1) It's open source, so if you can code and have time, you can help.
2) Some small friction adders seem like a small price to pay to not have a facebook product installed on my phone and suck all my metadata down.