I’ve seen more informative reporting from 404 media and others, Signal had more or less said they can’t guarantee security for third party apps. Which makes sense, I can’t guarantee a house I didn’t build is safe. The OP link also talks about how the hacked company is Oregon based, which is technically true that they’re registered there. But the reporting I had read indicated the company was founded and is run by a former Israeli security officer, and has offices in Israel.