To be fair, Apple and Google both put a lot of effort into making exploiting a phone as difficult as they can even in the case of an attacker having physical possession.

I’d much rather have potential “evidence” against me on my phone, than on my laptop.

The stakes are very high though, and the attackers very motivated and well resourced, and I suspect there’s enough political pressure on them both to do only “a good enough job to make it look like they’re succeeding”. If anybody thinks the NSA isn’t several steps ahead of both Apple/Google and NSO/GreyKey, wtheyre fooling themselves...

Does Signal not encrypt its DBs when not in use and upon shutdown?

Edit: it seems that Signal uses db protection but in a way that fails for a cracked phone like this (?): https://news.ycombinator.com/item?id=26096778

Generally: If someone has physical access to a device, you can probably assume they control it.