Is it possible for my ISP or cellular provider that provides data on a 3g or 4g network to hack into or install malware on my brand new Android phone and read my messages on WhatsApp?
Given that even brand new android phones often have yet unknown or even known security vulnerabilities it might be possible for someone who can sent data to your phone to trigger some externally accessible vulnerability in the code from outside. Through such vulnerability (or a combination with another) the attacker might even get root privileges on your phone and might be thus able to modify applications or inject himself into applications so that even reading of encrypted data is possible.
More likely than an external accessible vulnerability is that you have ISP specific applications on your phone which then only need some local vulnerability to get deep access to your phone.
Also, in many countries it is common that users get the phone from the mobile provider in the first place - and of course this provider might have added a backdoor to this phone and thus does not even need to exploit some vulnerabilities.
Note that none of these possibilities suggest that such attacks are actually done, only that these are possible. In most countries such activities by an ISP would be illegal. But even in such countries it is usually legal if the provider helps law enforcement to bug your phone if they have the appropriate warrant.
Yes, it is possible.
In some countries, the cellular provider preloads their own interface instead of TouchWiz, as well as their own apps. Some of these apps may come with backdoor functionalities.
For example, Android phones bought from Docomo comes with many apps, one of which is "Remote Support". By connecting to an operator, he/she will take over your phone to perform/troubleshoot whatever you need help with. While this preloaded app requires the verbal consent of the user, it wouldn't be impossible (privacy violating, yes) for it to actually not require any. And because it's a remote-control app, it can view your screen/messages regardless of what security you have, because the actions are essentially being performed by your hijacked phone.
One way to protect against that is to require a pin to open Whatsapp; some of the third-party antiviruses like Avast or Norton have an option for that. That way, your messages would be protected even if your phone got hijacked.
While it is probable that your Service Provider or whoever manufactured the hardware could have implemented a backdoor which may/may not be exploited, it is more likely that the What'sApp app has vulnerabilities which are more easily taken advantage of. Im not sure what the exact flaws of WhatsApp are, but I have not used it and have heard it has been attacked and leaked data(possibly an internal leak). Use a more trusted and secure encryption app, such as "Signal".