Mobile apps, both iOS and Android, are sandboxed. Effectively one should be not able to root and install malware just by exploiting an user mode app.

However, in this case, looks like it might have been chained with a iOS kernel exploit - a bad memcpy is suspected.

So we should blame unsafe programming languages and C culture once again.

Signal was not affected either, is cross platform, and has a lot of eyeballs on its source