There's a few ways that they can patch this. I'm assuming that there's some sort of auth process in place for their http calls and this could simply be a case where this particular endpoint missed the auth.

Or they're simply blocking the whatsappstatus's ip and a fix would actually require both client side and server side changes.

But honestly its just a messaging app and how many people really cares if "let's go grab a beer" is encrypted or not.