Recall is encrypted with a key in the TPM. But getting access to that encrypted sqlite db is a yawn.

Getting the key is harder, but possible. You can breach into Microsoft's group with a particular set of GPOs - if you can run a particular set of server commands on the local network.

Signal data is encrypted at rest. The key is stored in the OS store - usually meaning the TPM.

However, the key isn't in Microsoft's main grouping. To date, no one has extracted the Signal key this way. Other exploits are required.

Signal being smaller than the whole of Microsoft, reduces the attack surface.