Yeah, if a nation-state thinks you are a bad enough actor, they might use a high power way to get at you. See Pegasus, for instance
But those exploits are rare, expensive and can be blown.
No one has ever said Signal is perfect security.
But it is damn good. Your SMSes aren't sitting in plaintext on your mobile ISPs network. You aren't going to have them intercepted by a fake mobile tower. And if you and your recipients use disappearing messages, good luck to any prosecutor trying to get them off a device.
And as for Apple sending a fake update? Might could happen but 1) Apple fought this once and 2) it'd be hard to do in any widespread way without being detected
Saying Signal protects you from fuck all is not just wrong, it's irresponsible AF.
It's like saying that locks, firewalls, alarm systems, curtains and network monitoring don't work because some people know how to defeat them.
Signal is a great security upgrade for almost anyone. I love seeing more people use it.
Normalizing encryption is great.