The mayor issue IMHO is the dependency to Google Cloud Messenger as the only available push notification system for android devices and its dependency to Google Play store. I believe an actor as powerfull as Google can detect paterns and learn from the notifications it handles even if the text is encrypted.