Well it’s a fork of signal so makes sense

Malware in what manner?

From what I recall, Google would be able to see our device received a notification and when but not the actual message nor sender/recipient identity.

I think that’s fine for my threat model.

Molly seems like a potential alternative though since its a signal fork and supports UnifiedPush so you can choose a different notification supplier like ntfy or sunup