Sure. That's one possible vector. Is it "Open Source" software? Yes, they accept contributions for the community. It's is "Libre" software? No, they depend on closed source software.
I'm trying to illustrate that the definition of "open source" can be weaponized for no good reason. Dismissing Signal because it doesn't fit a narrow definition of "open source" makes everybody less secure. I have a hard enough time convincing my non-tech-savvy friends to switch to Signal. There's a snowball's chance in Hell I'll convince them to use something even more obscure.
Okay, so the Apache license is a "closed source" license?