Well, it is encrypted with a pin. Unless you make a long pin or switch to optional alphanumeric, the contact list is just protected by SGX and a short pin.
The SGX works like the iPhone auto-wipe. But it is in an online service with lots of juicy data in one place, so the target is bigger. A vulnerability could leak your contact list.
It sounds like the cost was non trivial for them, partially because they weren’t allowed to break things for python2, or even disrupt the efforts of those using it.
The language wasn’t ready for the transition, but it feels like it may have been even harder on them because of the requirements imposed on their project.
The SGX works like the iPhone auto-wipe. But it is in an online service with lots of juicy data in one place, so the target is bigger. A vulnerability could leak your contact list.