They are end to end encrypted. There's apparently a lot of meta data (like the people one communicates with, etc.) that can still be accessed by Facebook.
It also nudges users to enable cloud backups which in practice means that everyone has them enabled (...which in practice means that all your messages are unencrypted in the other person's cloud storage.)
