Rather than hacking Signal itself, maybe they were able to access the iOS app preview files from the iOS app-switcher? I'd imagine the app-switcher (the feature when you swipe up to switch between recently used apps) works by overwriting a screenshot every time it's minimized. Maybe they were able to access this data directly or indirectly (or maybe even via iCloud).

There's a setting in Signal where you can hide the screenshot in the app-switcher, but could still be triggered and stored somewhere. Or maybe they just got lucky and one of the guys had it disabled.