In my experience it won’t let you make a new account if it can’t access the SMS stack on the phone itself to see the confirmation code come in, so you’d need to somehow get the Signal confirmation code forwarded from a real number into Waydroid or whatever you’re virtualizing in. Not sure that is possible, but it may be. There would still be a 1-1 phone number to account association, though.

If that RAT post was real, it was done by pros and it’s by a miracle alone a definition for their trojan was in ClamAV, which never has bleeding edge definitions. If you’re actually concerned about that kind of thing, running wine in its own limited permissions user account (or not at all) is going to be better protection than relying on AV definitions.

They are, it’s in no way e2ee, this was recently reported

No, but as a result of behaving like the official client it is more robust than yt-dlp or Freetube when Google does crackdowns on third party clients. It’s a tradeoff of privacy v robustness, but it still has no ads and sponsorblock. It’s a way more acceptable option for normies and works well on GoogleTV (which is going to be spying on what you’re watching and phoning that home to Google anyway).