I assume he copy pasted the message on his unsecured device.

How many apps had access to that text in his clipboard?

To me this isn't a technical problem with Signal, it's an opsec problem, and that's quite a lot harder to explain to people.