They did not “choose” it as an official tool for internal communication. It was her private phone with a by her installed Signal. Besides that: Phishing can happen on any platform, especially one that is available to the public. Signal is not issue here and swapping email registration against verification by mobile phone number won’t solve anything.