The argument is that E2E encryption implemented by Non-signal may protect you against Signal but won't protect you against Non-signal

Perhaps Molly[1] could serve as an alternative client for you?

[1] https://molly.im/

This is precisely why I have autoupdates disabled for my Signal apps. They're on by default, which basically gives Signal-the-org remote code execution on my machine (same as Chrome's built in transparent autoupdate gives Google RCE on your machine).