BleepingComputer says it's been known since 2018 and Signal wasn't motivated to fix it until last summer.