It's the same thing on the phone. If you caught Pegasus, then using Signal doesn't provide any extra privacy - all your taps or keystrokes can be tracked and exported.