I tend to use SMS Backup & Restore deny it network permission, make a local backup, transfer it via whatever secure means you have to the other phone, point the app on the new phone to the backup, restore.
If you keep the app lacking network permission and wipe its storage & cache (along with uninstalling once used) you don't need to worry about any potential vulnerabilities in the app or the permissions it requires.
This method is free, easy to use, and easy to set up.