When you share albums with someone else, the key is passed in the URL. Nothing prevents Ente from grabbing the key and decrypting all the data at this point.
OP's point is, as a consequence of providing "useable security", the secret keys remain "exportable" (in this case, unwrapped in a URL fragment), which is an undesirable trait in some threat models. Let alone web-based cryptography, which in on itself is perilous: https://news.ycombinator.com/item?id=39436238
When you share albums with someone else, the key is passed in the URL. Nothing prevents Ente from grabbing the key and decrypting all the data at this point.
So it's basically "E2E, trust me bro".
Or am I missing something?