> Getting Signal from anywhere else other than them opens up the door for someone to sneak in some code.

Incorrect. See David A. Wheeler's seminal paper https://dwheeler.com/trusting-trust/

An easy way to avoid talking about strawmen is to avoid bringing one into the conversation. Something to think about.