Unfortunately, this confirms what I’ve already suspected about Matrix all along: https://gist.github.com/soatok/8aef6f67fec9c702f510ee24d19ef92b
I looked into Matrix back in 2020 on a far more superficial level. Back then I simply wanted to know whether non-technical users can rely on Matrix for encrypted chats without shooting themselves in the foot.
What I found was a huge mess. The different Matrix clients all had very different capabilities, also when it came to encryption. It was pretty much a matter of luck whether your Matrix client could establish an encrypted connection to another Matrix client, whether it would do so by default and whether it would notify you in a useful way if it failed to encrypt the connection. Even the official Riot messenger didn’t perform well. There clearly were no baseline requirements, and expecting users to recognize whether they are secure or not just doesn’t work.
I later got a reply from the developers. I can only quote approximately since that was on Twitter so the conversation is lost now. It essentially boiled down to the fact that reliable encryption was never a design goal of the protocol. They wanted to give client developers the most flexibility. So client developers took that and largely implemented only the easy parts.