Signal added a layer to make sure you are talking to the right person: contact verification through a manually confirmed code. Against social engineering, it's a good step. Between humans, it works.
The gap opens when the conversation is mediated by code. If an agent is reading and replying, the verifier isn't a person, it's a system. And a system has no instinct: it won't find a swapped contact odd when the message looks legitimate, the display name is close enough and the pretext is convincing.
The scenario stops being hypothetical in any operation using an agent to read and answer messages while taking instructions through a chat app. If an attacker gets the agent to accept a new contact as trusted, no amount of encryption helps: the data goes to the wrong hands and nobody notices. At the moment a first message arrives from an unfamiliar number, the agent has no way of knowing it isn't the original one.
The practice that actually holds isn't in the app. It's never trusting that the sender is who they claim to be. An instruction written into a request is not access control. The design that survives is a list of authorised contacts loaded when the system starts, with every incoming message checked against it: a number that isn't on the list gets dropped or queued for a human.
Verifying a profile is good. Verifying identity inside the code is the part you cannot skip.