I keep thinking that the real story about this Signal stuff is that whatever authorized government equipment/software they’re supposed to be using probably just sucks. Onerous, old, too much authentication, password silliness, biometrics, auto logout after 2 minutes, etc etc.

Do not mean to downplay the mistake (at a minimum, the SecDef should suffer the same fate a lower ranking member of the DoD would for reasons of military order), but humans will be humans. Dealing with security sucks and involves trade offs and compromises.