The alarming extent of US-affiliated signals intelligence collection is well-documented, but in the case of Threema it's largely inconsequential; you can still purchase the license for it anonymously, optionally build from source, and actively resist traffic analysis when using it.

That is to say: it allows a determined party to largely remain anonymous even in the face of upstream provider's compromise.