Pegasus was much, much more intrusive than a targeted payload from the Play Store and it took years before that was discovered. Note that Signal is specificall

Pegasus was much, much more intrusive than a targeted payload from the Play Store and it took years before that was discovered. Note that Signal is specifically not allowed to be distributed outside of their own apk download and Google/Apple. They have made that repeatedly clear and will take measures against such distribution. Security is not a scalar. It is probably better for the mass audience but worse if your adversaries includes Google employees. Take note of your threat model. From what we know of three letter agencies, they probably won't bother. They prefer spyware-like control of the end device. That way they don't need to target the encryption of individual apps, it is far more effective to collect communications after it is decrypted and read by the target.