They do control the content on the notification. It's a bit odd to put the sensitive text in the notification only to recommend disabling it at the system level.
Signal does NOT send encrypted notification, they send a blank notification that act like a ping, the actual encrypted data is then fetched by the app itself.
Sorry, the “recommended” was a bad wording on my part. The recommendation comes from the 404 Media article who did the expose on this incident, not Signal itself.