> it allows the app to ensure the code comes from a correct Signal phone number and not from a third party actor.

But if they sent you the code, even if a third party actor could somehow see it and hand it to you instead -- so what? What's the difference?