Can they? First they'd have to never have accepted contributions, then if they ran an updated version on their server wouldn't they be in vialation of AGPL (not providing end users, in this case specifically those who use Signal an updated codebase).