The opnly confirmed thing I have heard is that they can read signal messages via your notifications, if they are enabled, so always check the app manually and do not use their push service.

While the capabilities of Pegasus may vary over time due to software updates, Pegasus is generally capable of reading text messages, call snooping, collecting passwords, location tracking, accessing the target device's microphone and camera, and harvesting information from apps.

https://en.wikipedia.org/wiki/Pegasus_%28spyware%29

Once installed, Pegasus has been reported to be able to run arbitrary code, extract contacts, call logs, messages, photos, web browsing history, settings, as well as gather information from apps including but not limited to communications apps iMessage, Gmail, Viber, Facebook, WhatsApp, Telegram, and Skype.

If your phone has been compromised, nothing is safe. That’s not a signal problem.

Throw the phone away and get another one.

In theory everything is possible because only Apple/Google+OEMs are running root on your device.