> If someone manages to install and enable that on a target's phone, then it renders Signal and all other secure apps useless.

So does installing a compromised USB keyboard or a broken Logitech receiver. Why is that Signal's problem?

Because what GP points out is that in China everyone uses Baidu's third party keyboard. So Signal alone enough is not enough to ensure safe communication.

This isnt a signal problem, its an android problem. I don't see how Signal could fix it, short of developing their own keyboard for their own app only but that would break a shitton of android accessibility features.