Luckily they are working on transitioning away from requiring a number. That will be an improvement.
fAt present, a spammer needs your phone number and a source phone number in order to spam you. A suitable source phone number isn't difficult to get, but presumably spammers' numbers will be blacklisted by Signal as soon as someone complains about the spam. If they drop the need for a source phone number, what will replace that threshold? Do you know?
https://teddit.net/r/technology/comments/kt91qk/signal_priva...
I wish they'd be more open about this, since it's one of the biggest hurdles with Signal.