I wouldn’t consider WA secure. They do tracking, they have your phone numbers and those of all of your friends and know exactly who you talk to, when, and how often. Even if they don’t know the content of the message because it’s encrypted, that’s a lot of information for the algorithm to feed on. Apart from that, I’m not sure if they have access to the encryption keys. They might be able to decrypt everything if they want.
I’m sure someone wrote a lengthy blog article about WA. But unless someone does a proper security audit including where the encryption keys are stored and the implications of that and how extra features like breaking encryption in case someone flags an inappropriate post turns out… The ‘it’s safe’ is just a claim by your brother or Meta. You’re free to believe in anything you want. But it’s not necessarily true.