Right, among the reasons not to use Signal for this sort of thing is that it is explicitly difficult to verify within Signal that a contact is who you think it is. It can be a secure channel if used correctly. This shows these people are not using it correctly.