There is no "secure" or "not secure". To quote the famous Kenobi: "Only a Sith deals in absolutes".
That means: there's varying degrees of security. ChromeOS is considered as "secure" compared to other desktop operating systems, because it limits the control over the system itself, reducing attack surface in the process. WebApps are less secure because they have to load code from the server on every startup that can potentially be tampered with. A regular (desktop) app is verifiable, a WebApp is not. So for a service like Signal, that has to offer the most security possible, it's more reasonable to exclude unsafe methods to reduce attack surface.