At least from the folks I’ve talked to he is not well-liked

Signal is open source, right? Though that wouldn’t stop a bugdoor, it might at least make one harder. As you say, I think getting in through the OS itself is much more likely. Signal would put up much more of an ideological fight than Google, I imagine.

I mean, unless somebody is burning browser zero days on random public QR codes I’m not too worried.