> Radha Stirling, chief executive of London-based advocacy group Detained in Dubai, said Dubai police had "explicitly confirmed they are conducting electronic surveillance operations capable of detecting private WhatsApp messages."

And later it mentions that they "also" use the Pegasus spyware. Although I'm not sure I'd trust that as actual confirmation that this was a separate attack vector. Even if "someone in the chat leaked it" is AIUI the most common way something like this would happen.