But those are two separate actions: - Signal transmits a code (exploit) and keeps it in its cache, the code is dormant, nothing is being damaged here, it could

But those are two separate actions: - Signal transmits a code (exploit) and keeps it in its cache, the code is dormant, nothing is being damaged here, it could stay like this forever, no harm. - Cellebrite transmits Signal's files and cache, including the exploit, and gets hacked by reading it with their scanner. The key is that the first action is harmless, and the second action is performed by Cellebrite, so can't blame Signal for it. I don't think these two actions can be consider as one. And the main difference from the malware scenario is that this Signal code is not meant for reading, it is inaccessible and harmless for anyone except the Cellebrite hackers. The exploit is activated by unauthorized use, unlike the malware.