The built-in apps get and send SMS from a system service on Android. In nearly every case the system app is from the same vendor as the system itself which means there’s no significant opportunity for data disclosure that doesn’t already exist within the system. Therefore if you don’t trust the system SMS app, you shouldn’t trust the system either. If you trust the system, you can probably trust the system SMS app too.