Signal is an excellent application but security requirements at such a high level mandate an exceptionally high-security device and operating system as well. The weakest link is the device and operating system they're using. I'd be very disappointed to hear if they had been using their personal iPhones or Stock Android devices for this (and it seems like they are, why the hell would you have a random journalist on your phone?). State actors would laugh.

Sensitive Compartmented Information are meant to be handled in unique facilities...

There's an improvement if they had a high security operating system (shameless plug) but even then it should be more bespoke in my eyes. The whole purpose of the device should be just to communicate over their service and nothing else.