I did not say, nor wanted to imply that Signal is not FLOSS.

Just that Signal is not on F-Droid. Which has a bit of a history and some drama. It was there, log ago. Still textsecure back then.

Sure, you can build it yourself. And from there, with some hoops to jump, install it on your phone over adb (it's what I did). But that is far from fdroid or some other app store. E.g. there are no updates, which is a crucial feature in a security-critical app.

There is also fdroid repos such as [1] that contain signal. Fdroid policy requires approval from the author to be included, which is a bit weird take at FLOSS.

[1] https://calyxos.gitlab.io/calyx-fdroid-repo/fdroid/repo?fing...

> Telegram has also been exploited multiple times

Source?

Here's one: https://www.zdnet.com/article/telegram-voicemail-hack-used-a...

This had nothing to do with code vulnerabilities let alone open-source in general. It was a social engineering hack relying on default voicemail passwords.