"A forensic analysis of Mr. Aude’s Apple-issued work iPhone reveals that, between June and September 2023, Mr. Aude had over 1,400 connections with a single journalist via Signal."

I'm also interested in this forensic analysis.

They could because it’s his work phone get the push notifications stream and analyze that... that would leak the metadata needed to connect him to the reporter.

That's plausible, although it would be quite egregious of Signal to send plaintext push notifications (even of only the contact name) in my opinion.

It isn't difficult to contrive possibilities even in the case of using practices for an iDevice (such as for the screenshot: find incriminating picture [somewhere] -> search for picture hash -> find out that Aude has that same picture on his phone even though it is using iCloud Advanced Data Protection).

The real interest is in the explanation they give and if it is plausible or if it seems to be parallel construction to cover pushing out specialized signed software to employee phones to detect this.