You are definitely right but it's probably almost right at the sweet spot. Decentralization/federation is great for privacy, but think about what most non-technical people can handle. With federation alone, practically all non-tech people would even fail (or be confused by) the first step, namely to find an instance.
So are there more privacy friendly options than Signal? Definitely. But are those user friendly enough most people could use it? I can't think of one, but would live to hear some alternatives that are simple enough my mom could use it.