[agret]

Should read the article before you comment next time ;)

There is a screenshot in there showing it is directly parsing the Signal sqlite database. I am guessing on his device he had not set an access passcode to the Signal app so no key was required to decrypt the local message cache. Towards the end of the article the Signal creator hit the nail on the head saying this is a phone security issue and nothing to do with Signals security.