There isn’t any proof that the app you download is built exactly from the source code on github. There could be an intermediate step to inject whatever they want before packaging it for the app stores.

There’s also the conspiracy that Signal has been compromised since the beginning as they received initial funding from the CIA. Not sure exactly where I stand on this, but it is plausible.

The protocol itself is open source though so someone could make an open source service with that.

Perhaps if it was in a vacuum but musk has openly shared Nazi propaganda on his social media site that he bought. The ADL is an organization I don’t trust