They can only impersonate you that way if your contacts dismiss the warning about your safety number changing. If you're being directly targeted by the government of a wealthy country, using a specific app isn't enough to prevent surveillance; you'll need some actual opsec.

Signal offers direct key verification (which you need to do out of band) or transparency log key verification (your device can check that senders who you add by number hasn't had their key change)

The attack here was getting an unlocked device in hand and using the internal sync feature without the user's knowledge, and the solution to that is always to check your phone after an untrusted person handled it unlocked (or with Cellebrite type devices) - or to simply not offer access to the Signal app while unlocked (perhaps even uninstalling it first).

There is no app which is fully secure against an untrusted third party getting physical access to your unlocked phone, especially not if you have a weak PIN or just fingerprint unlock

The other ones aren’t encrypted.

Whatsapp is encrypted as far as I know. But then again, it's Meta, so my trust in that is near zero.