Disregarding non-IP candidates is exactly what we've chosen to do (and which the new versions of the app do).

The downside of disregarding all candidates until the call is accepted is that post-accept connectivity would be much slower.

Going through a server to hide your IP is an option in the settings in the app, but it can potentially lead to higher call latency, so there is a trade-off.

To prevent issues like this in the future we are taking more control of WebRTC's behavior with a fork of WebRTC (Signal uses WebRTC) and are providing patches to upstream WebRTC as well.

(I work at Signal on calling)