They don’t necessarily need RCE access.

Also this isn’t how security works. Please refer to the Swiss cheese model.

Unless you can guarantee that every application ever installed on every computer will always be secure under every circumstances then you’re already breaking your security model.

An application may expose a vulnerable web server which may allow read only file system access without exposing the user to any direct control of their computer from an attacker. Now your lack of security posture for your application (signal) now has a shared fate to any other application anyone else built.

This is just one of many easy examples that are counter to your argument here.