Signal doesn't advertise a profile. It advertises a phone number - everything else is data you have locally. It will send a profile picture if you set one but that's it.
Does it advertise your username? If I don't have the name of the contact, will Signal share my username or does it just say "this number in your list has joined signal, and here is their profile?"
Nice. Sounds like the same rules apply to profile pictures as well. That feels like a step in the right direction, but it still means that by having family/coworkers/college buddies/etc in your contacts, they can see your profile picture and username. I know this can be a sticking point for some. It would be great if Signal introduced finer-grained privacy controls so it could appeal to an even wider audience.
You can download leaked phone numbers of millions of ppl and add them to your phone's address book (iOS limits contacts to 50k). I don't think this is very secure.