I agree; however, the second point I don’t see as Signal specific. In any service, how do you verify that a server is running unmodified open source code? For the vast majority of people, they are also depending upon the client being unmodified.

What security issues does Signal have?

RCS doesn’t have a cross-platform end-to-end encryption solution. For cross-platform communication, cross-platform 3rd party solutions such as Signal work well.