Apart from Signal just generally doing a good job here, I see a few other possible factors:
* Signal doesn't see user content, so it doesn't have a content moderation team
* Signal is designed in such a way that it can't comply with most kinds of legal requests for user data, so it doesn't need a large team responding to those requests
* Signal gets some amount of pro-bono legal help, so it might not have as large an in-house legal team as other organizations
* Signal isn't trying to directly profit from user activity, so it doesn't need to study user activity or engagement metrics with a view towards profiting from them; similarly, it doesn't need to manage relationships with advertisers
* Similarly, it doesn't need to try hard to grow its user base (that would be desirable, but it doesn't necessarily increase revenue much)
* Similarly, it probably doesn't need to try hard to expand into other business areas
(I think these things are generally great. Yay Signal!)
But it's likely they leave that job to their beloved Google, since they haven't changed course even after the compulsory handing over of signing keys to them.