Actually seems like in this case the global “allow unknown sources” setting is still disabled on your phone, not the app’s permission. But you will see this dialogue if the app you’re installing from doesn’t have permission as well.

That’s something else. That just means that whatever app you used to open and install the apk doesn’t have the permission to do so yet.

By default whatsapp makes unencrypted backups. You can enable encrypted backups, but then of course if you lose the password you can’t restore the backup.