As an example, a piece of code sending authentication credentials in plain text across the internet might in isolation be considered free of bugs. But it should never do that to begin with, it should have been designed/architected quite a bit differently.
You are free to carry water for Signal while they repeatedly refuse to even explain why they consider this a valid approach to handle the users data.