"Secure" is a question of threat profile and use case.
Take Signal as an example. It requires association with a phone number and the people who control its databases & infrastructure are under the jurisdiction of the US. Given probable cause, any law enforcement agency in the US can get a subpoena to require Signal to tell them if your phone number has a Signal account and the last time you used the app.
Contrast with SimpleX. No court order is going to associate a phone number with using SimpleX or the last time you used it because that information is never collected in the first place.
Whether or not any of that is relevant to a specific individuals use case, threat profile, or security concerns is a different matter.
Personally, I don't use Session but I haven't seen anything to indicate that is fundamentally insecure or flawed for most use cases and threat profiles.