eggy
You must be the enemy of the state to worry about the type of state-level malware that you're describing here. The odds of running into that type of zero-day stacking malware to crack through GOS to get your Signal DB is basically 0.
I at least hope I'm not "enemy of the state"-level, but there's a lot of countries with really long shit-lists, and you never really fall off them if you get on one. Best you can hope for is falling to the bottom. But more importantly, and more the topic I'm interested in here, is that the availability and use of high-end spyware has exploded over the past decade. The biggest shift is more actors have access to them, while another big shift is more of a "use it while you got it" approach in comparison to the previous "Million Dollar Dissident" reserved for the highest priority targets.
Taking a step back, leaks show that the predominant method used by gov/LE prior to the mid-2010's widespread adoption of E2EE was passive bulk collection of plaintext messages (through lawful intercept in telecos, tech provider cooperation, or breaking into a service provider's network). While metadata is certainly useful, some legitimate LE/gov efforts were hampered by E2EE. So would the world's governments just give up? Of course not, especially when companies can make a huge profit selling exploits and toolkits to them. On one hand, I think this change is good because for message plaintexts to be read by outside actors they have to pay for the rare tools and take the effort to go through all the effort to exploit your devices and analyze what they extract for each target compared to the previous passive bulk collection that collects against everyone by default. On the other hand though, mobile exploitation was a lot more limited and efforts generally went more into breaking into nation-state adversary enterprise networks. Now that many chat apps are E2EE, the only way to really read the messages is a mobile app or OS exploit chain. So as the "need" grew, the capabilities shifted from being reserved for only infrequent nation-state spycraft to even small countries with questionable human rights and oversight (see the list of Pegasus users) using them somewhat frequently in criminal investigations but also for oppression of journalists and activists.
While it used to be a few hush-hush defense contractors selling exclusively to the top tier governments, the industry has now exploded with both formal Vulnerability Researcher positions openly posted all over job boards in multiple countries and underground/gray market resellers. Also, as defenses have increased, so too has the availability of knowledge for getting into binary exploitation and exploit development, opening up the field. In addition to developing them yourself, capturing them from adversaries and reusing them surely happens too. When Kaspersky captured "4 zero-days, 2 checkers, an implant, and its modules" from an NSA-like adversary in Operation Triangulation, do you think there's any chance those weren't passed to Russian intelligence and reused months before public disclosure? Even ICE's little-dick fascists can use Paragon spyware again.
Even more likely than catching Paragon after pissing off some douche who got a badge and a $50k bonus to beat and shoot US citizens along with harassing minorities - is the crazy phenomenon of indiscriminate high-grade watering hole exploit attacks by China on compromised websites like a Uighur diaspora site in 2019 and Hong Kong democracy movement sites in 2021 which have both been deemed "a paradigm shift" in the rampant and automated use of zero-days against desktop and mobile with no selective targeting. I might've actually been caught up in that second one when I was following the events back then from primary sources only a bit deeper than the main headlines.
Probably the most worrying capabilities of mobile spyware though is that it can transmit your constant geolocation, activate the microphone to record in-person conversations (even while in your pocket), record audio calls (even E2EE), and allow exploiting other devices from within a local network. These are key abilities that a post-seizure forensic analysis can't provide. So compared to the 55,000 warrantless phone searches in 2024 (but likely higher in 2025) by CBP at the border to see if anyone said anything bad about Trump, I'm a bit more worried about the remote spyware floating all round the world than a phone seizure and forensic analysis (even though those are only US border crossing numbers and don't include FBI, state, and local authorities).
That's not to say I necessarily think my threat level is high enough to be specifically targeted by any of these threats, but I'm a hobbyist infosec nerd trying to see what's the most secure setup I can get while having a good bit of tolerance for inconvenience. Also, I recognize none of the above referenced exploits mention GOS, which is why I'm using it :)
Some good additional reading on exploits/spyware are Google's Buying Spying report (Google has good security because they want to make sure they're the only ones who can spy), the Atlantic Council's Mythical Beasts report and interactive, and ETH Zurich's From Vegas to Chengdu and Before Vegas reports.