Or, if the app has the private key for decryption for the user to be able to see the messages, what’s stopping the app from copying that decrypted text somewhere else?

The thread model isn’t usually key management, it’s more about the insecure treatment of the decrypted message after decryption.