I have sympathies for this argument, though it boils down to trust. Even if you roll your own client, you still need to trust some things outside of your control, be it your build environment, your phone, whatever. But most people will use somebody else's client, so need to trust whoever built that one. Or whoever supposedly audited it. The Signal authors just play that role here. Their business model is fundamentally different that that of Google or Meta, which is a main source of trust people are putting into it. Offloading the exposure to a minimum (just the client which is open source) is another. Yes there are ways around all that for an attacker, but in the end it's a game of likelihood. A journalist or dissident fearing for their life may have a different conclusion than mom and dad who want to coordinate a birthday party without big tech reading those messages and selling them to ad companies. It's good to err on the side of caution, but acting like I am the former while in reality I'm closer to the latter user type is in the end just theatre.