I think it means that if you're a target, they can get it. None of the mobile baseband software is free/libre. They probably attacked his phone rather than breaking Signal or its protocols directly. At least that is what I hope: active target (screwed) vs passive collection (secured). Another explanation could be that Signal is a US company and is therefore subject to National Security Letters. Not much Signal could do about those, I imagine. So it could be completely compromised. I hope not.