Signal didn't publish the source for their server-side from 20 April 2020 to 6 April 2021 while they secretly added a cryptocurrency payment system. Open source is only open if the source is available (and yes -- if their end-to-end encryption system is working properly than even a notional malicious server would not be able to intercept message contents, but could of course provide metadata, and also you have no way of verifying that the app you install via whichever app store you install Signal from was built from any given source).