I agree that signal has a more robust security model. What I mean is that itbhasbalso habe risks, and a lot of people are ignoring it.
The backdoor could be a sleeping function activated from outside to targets of interest or 'special' updates from the google store (i.e.: with the help of google install a different version of the app to the target). But I'm not a security nor android expert, and it's all theoretical if this attack vector is possible, but I think that is unlikely.
Also, if the NATO country where I live wants to spy my mobile, it would use Pegasus 🤷🏽♀️
Off topic: The Signal reproducible builds don't work since, at least, may.
Nice terms of service: