> Threema run & operate all their own servers - that’s good & bad in my eyes (do they know what they doing? Has any of their infrastructure been security audited?)

Afaik that's not different to Signal.