Apart from Signal just generally doing a good job here, I see a few other possible factors:
* Signal doesn't see user content, so it doesn't have a content moderation team
* Signal is designed in such a way that it can't comply with most kinds of legal requests for user data, so it doesn't need a large team responding to those requests
* Signal gets some amount of pro-bono legal help, so it might not have as large an in-house legal team as other organizations
* Signal isn't trying to directly profit from user activity, so it doesn't need to study user activity or engagement metrics with a view towards profiting from them; similarly, it doesn't need to manage relationships with advertisers
* Similarly, it doesn't need to try hard to grow its user base (that would be desirable, but it doesn't necessarily increase revenue much)
* Similarly, it probably doesn't need to try hard to expand into other business areas
(I think these things are generally great. Yay Signal!)
Another issue might be that without good management, the marginal utility of each new hire goes down fast. As a company trying to launch new features, fixing management is hard to measure and fix, but hiring is simple to measure and seemingly solves the problem.