Comment by Zak

I don't think using Signal is the biggest problem in terms of security, though it's against the rules to use something not explicitly approved.

The bigger security problem is that it was being run on devices that evidently weren't limited to secure communication tasks (such devices wouldn't have a journalist in their contacts). That suggests at least some people were using personal phones, which seems like a terrible idea.