The article is clear: download from the Signal site is not secure.
Or are we just going by the author's ignorant or disingenuous (depending on how you interpret his words) statements?
If you are so concerned about state-level actors that play store is untenable to you, signal and android on commodity hardware are probably not the solutions you want anyways.