If I remember correctly the claim was from a Chinese citizen who pointed this out and when Signal didn't treat this as a major security issue (which I felt was understandable given that her concern was mostly along the lines of "you can't say that Signal is secure given that people install other software on their phone that could be a keylogger so you should have a disclaimer") she decided to continue to escalate on social media until she was, IMO, harassing Moxie for his "lack of engagement". I didn't come away particularly impressed by that exchange.

Exactly, this had nothing to do with one person being Chinese and the other being white.

And what was the suggestion? The flow of information is (You typing → IME converts key presses into text → Signal receives text) so Signal can't do anything to prevent a malicious IME from sending the text elsewhere. The best they could do is raise users' awareness that Signal won't protect them if there's spyware with privileged access on their device, and that their IME might be such spyware.

Mainly the OS has security options to prevent IME network connections that aren't always on by default, but users can enable them. (They might be off because it disables some features that need internet access.)

IIRC there was also some Android API that could be used in the app to help, but I don't remember what it actually did atm.

Perhaps your man the incognito keyboard option? Signal uses it, but no API I can imagine will protect against a malicious IME.

Worse still, even if you block IME internet access on a device with a factory-maliciois IME, they could just upload the data using some other service on the device.

Installing a known-good IME seems like the only fix I can think of?