Privacy

Signal Foundation is a nonprofit in California, and they are the ones that operate the relays and maintain the FOSS app. Since they're a regular 501(c)3 and not a religious org, you can look into how their money is spent (to see if it's going to any suspicious recipients) and whether they're getting suspiciously large sums of money.

On top of that, they don't have access to the communication data itself. It's all E2EE, and the app being FOSS means you can inspect how that data is encrypted and sent (and even build your own from source, if you're paranoid). Even if they're unknowingly hiring covert bad actors, it's unlikely their activities would stay hidden for long.

So while it's certainly a concern that it's still centralized messaging, it's probably one of the best options due to the easy access for most people. Other than a billionaire buyout or government laws that force backdoors into encryption, the only real existential threat they currently face is operation costs. They were fortunate to have wealthy philanthropists in the beginning, but if they have an explosion in users (unlikely), it might bring the organization to its knees.

I don't find your particular scenario to be worrisome. And if it turns out that it's compromised in the future, there's other good apps out there, like SimpleX.