If that were the case, why doesn’t the same principle apply to Cellebrite? After all, they exploit vulnerabilities in lots of software to deliver their own services and there’s no indication they share their work with the vendors.
The proper perspective is not to look at "exploiting Cellebrite's software" an "exploiting Signal's software" but to look at who has the lawful possession of specific devices that software is running on.
It's not a crime to exploit vulnerabilities in software developed by someone else, it's a crime to exploit vulnerabilities to do things on systems owned/run by others.
A LE officer with a proper warrant running Cellebrite extraction tools on your phone has full rights to execute exploits on your phone.
On the other hand, the phone's owner or Signal has no right to execute exploits on that officers' computer with Cellebrite tools. They can get their own computer with Cellebrite tools (as Signal did) and exploit vulnerabilities there as much as they want (as Signal did), and not tell the vendor the details (as Signal did), that's all legal, but deploying an exploit on phones with the intent that it might get executed on someone else's machine is illegal.
Cellebrite isn't definitionally lawful. It's a private company that sells to other private entities that may or may not choose to use their software lawfully. I don't think they (should) get a pass just because some of their clients happen to be LEO.
Because they don’t plant boobytraps in their wake.
Signal isn’t saying “we’re just hacking into property we have a legal right to access” (which is what LE is doing in the US) they’re essentially saying “we’re gonna hack and damage government property and police evidence”
