There’s still some “trust” required in both Whispersystems to not backdoor updates, as well as Apple and Google to not backdoor the distributed apps after Whispersystems submit updates for publication.

There is though, some ability for skilled enough people to “trust but verify” by reversing the app bundles after publication. I believe (but not for any good evidence based reason) that there are “enough eyeballs” interested in Signal that _hopefully_ if a backdoored app update ever appears the white hats will raise the alarm quickly (I have no doubt the black hats will sell the details to NSO/GreyKey just as quickly...)