It’s just a separate part of your ISP costs.

Any good VPN will let you choose the jurisdiction of the endpoint.

VPN, with an endpoint in a nation where Signal isn’t particularly popular, so nobody thinks to fuck with it.

Identifying and responsibly disclosing security flaws is legal; publicly exploiting them is not.

“Security Flaws” implies that there was some attempt to restrict access that could have been considered “security”. They made no such attempt. Everything was openly provided to the general public.

Putting a big bowl of candy on your front porch during Halloween is an “invitation”, not a “security flaw”.