Seems more like a core OS issue than something Signal specific. iOS at least disables keyboard apps' network access by default, Android users seem to be screwed (as usual) unless they root the phone and install a firewall..
I think the issue is that Naomi is seeking official recognition of this system flaw but signal and moxie have not done so in response to her questions. I think “signal creator acknowledges that signal is not always secure” would be a headline that would help non technical people understand this system flaw.
Why do you say that. You are free to block any app on Android from accessing the internet, including keyboards, from the standard Android settings, no root or anything.