Metadata is data. While we can be pretty sure that message contents are secure we have to rely on trust for the metadata.

I use Signal and trust it way more than most other apps but still, one have to be careful, a state actor could still find ways.