Probably because the common mindset here is that anyone can make a mistake, and that the person who did it learned their lesson and will never do it again.
(And as I mention on a nearby post: you don't have to fix it to widely disclose it; like, you don't work in the dark to fix an issue like this for seven months as, even if it were your "top priority": you quickly time box it and then disclose the issue so people can mitigate their exposure or help better crowdsource finding the information you need to fix the issue.)
Combine that with not logging user behaviour heavily for privacies sake makes this a very tough one to replicate.
All of which was addressed in the bug report.
The realities of software development on a large scale with a privacy focus are sometimes hard to grasp. Although I do admit 7 months for a production release is quite a long time, even factoring in the pandemic and mobile app Play Store release cycles.
I get the motivation with a security/privacy critical app like Signal but this would also be a UX and customer support nightmare that IRL could grind a project to a halt.
Not to mention expecting users to know how to balance the risks of said bugs vs not using the app at all because they were scared off it. Back to using far less secure options.
I think having public forums to report and track the bugs for more advanced users is probably the right balance.
The better solution is internal fixes and triaging the serious bugs appropriately so they get the attention they need. Instead of just offloading highly technical information barrages to average users.
Temporarily blocking features until a patch is released is something that could make sense. But again only in certain circumstances. You can turn off photo sharing here but other cases it’s not so straight forward without crippling the entire app for a rare bug. It’s a difficult balancing act without a uniform solution.
Latest example: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Released Jul 1, 2021
Workarounds:
Option 1 - Disable the Print Spooler service
Option 2 - Disable inbound remote printing through Group Policy