You're correct. There are more security features with signal too like the server stuff. It's true that they don't update the code enough but the parent is being overly critical. It's not like WhatsApp is giving us access to the server in any form. So it's not a fair comparison. (Edit: Also, the app can be built from source and you can verify that the communication isn't happening in a way where the server could decrypt it. So it's not too big a deal that the server isn't perfectly up to date on public commits)

To their point, there are benefits to federated systems. But I've yet to see a federated system have moderate to large usage without becoming centralized. Think email. And until this problem can be solved you're still left with a "trust us" problem. There's no trustless system out there, yet. But hopefully it comes in the future. In the meantime, signal is the best if you also want to communicate with anyone that can't tell you if a stack is FIFO or LIFO (or even know those acronyms).