What good is strong crypto if your endpoint is compromised? If I can take screenshots and keystroke logs of you in Signal, all the crypto in the world won't help. That's the kind of spyware this article is talking about - full endpoint compromise.