[tptacek]

That's the point. They don't.

[hunter2_]

I don't want to speak for the parent commenter, but I think the concern is that the local app could be exfiltrating the contact list (and then by the exact same logic, message content as well) in some side channel unrelated to anything seen in the published source code, unless (a) the user builds the apk from published source code themselves, or (b) if there's some way to prove that the apk received via the Play Store is identical to one built from that source code.

Is (b) achievable by all users who have this concern?

[marsokod]

For the most part, and for Android users, b is achievable : https://signal.org/blog/reproducible-android/