Someone made a compilation of academic reviews and blogposts here: https://community.signalusers.org/t/wiki-overview-of-third-party-security-audits/13243 but none of them seem to be real security audit reports, ex. compare with real security audits to Delta Chat: https://delta.chat/en/help#security-audits
That’s a big one, you can disable it, but if the other person has it enabled there is a possible leak after decryption also.
Exactly the issue, same as always. Signal got rid of sms because it was insecure but enable reply in notifications by default.