You are both sort of right. Signal's on device storage is AFAIK only weakly encrypted with your screen-lock password (although you can enable a second weak password in Signal specifically). So if your phone is unlocked and backdoored the attacker can pretty much do what ever they want including reading your Signal messages.

Edit: to make it more clear... someone with a backdoor can just start a hidden application that does the same as the Signal client and open the on device stored messages with out your knowledge. And it is also quite trivial to install a keylogger to capture all passwords including those inside Signal.

If a device is compromised, the adversary can do whatever they want: screenshots, keyloggers, fork Signal and install their own client.

If your phone is compromised, anything that you can see they can see as well. Absolutely nothing can protect against that because the only way would be to prevent even yourself from seeing it.

Potentially a really good sandbox and strict permissions could help, but if someone were to backdoor your phone chances are they can get around most software based solutions anyway.

Try molly -- hardened fork of signal. With encrypted keys as soon as you lock it after using the app it shreds itself from ram.