True, they don't exact need signal. But the thing with exploits is that, once found, they would be patched and they can't use the same exploit again. So they can't just be sending everyone in the country Pegasus. That would make it easier for it to be detected.

So with Signal's help, they have a easier time to select a few targets. They can find out who is using Signal, and correlate that with other data like being near a protest site. Then they only need to target a few Signal users, instead of like sending Pegasus to 5000 protestors, they could find out that everyone is talking to this "John Smith" person, then send pegasus to that user and obtain a lot info And since its only few users being infected, its less likely for the fact that the conversations are comprpmised to be known.

I mean, without requiring phone numbers for Signal, they would have a harder time knowing who is using Signal, and they would end up having to infect all 5000 phones in the protest area, which mean now its much more likely for the spyware to be detected. With infecting just a few of the organizers, their spying can remain undetected for a long time.

As for everyone else not using Signal, they are likely to be using unencrypted messaging, so its not even necessary to infect their phones.