If the vault hurts police officers who had a legal warrant for opening it, through a feature that was purposefully designed for this, I would bet that yes, it would be completely illegal, and both the manufacturer AND owner (if it can be proved they were aware) may be held responsible for the injuries.

Similarly, if your app/device damages government property and tampers with legal evidence, both you and the creators would likely be held responsible. Even if the law may be unclear, you will definitely face charges for this, given how defensive police departments are in these cases (there was one case where a person they beat up had extra charges brought against him for dirtying the officers' uniforms with his blood... ).

Furthermore, simply creating exploit code and releasing it into the wild is illegal, so Signal, if it were ever found to have done what they let us believe they could do, could be held legally responsible, even if the code never made it to exploit a live system at all.