Vulnerable software is different from malware.

Iirc there was also the part of the story where the exploit for Cellebrite's thing was included in Signal, and Marlinspike said that data on any device scanning Signal with Cellebrite software would be poisoned.