My conspiracy theory brain goes:

Its funded by the government.

Yes, the messages themselves are encrypted, but they don't need that, they have access to all the useful metadata.

They can find everyone near the site of a protest (via cell tower data), then find their signal accounts, then see who they are contacting, potentially revealing who the the other protestors and protest organizers are.

And if you need access to the messages, they don't need to crack the encryption, they could just send pegasus to your phone (and they already have you phone number to do so), and they'll have access to every message.

Then they just find those other protestors, also send pegasus to their phones.

I mean, the Signal code is technically legit, they just used a side channel (zero day exploits) to gain access.

But this is just a theory, I don't have any evidence supporting this hypothesis.