I imagine one of the phones are compromised, not the signal app or system. An app, including SimpleX, is only as secure as the environment it is being executed in #GrapheneOS