Is it really safe to use Signal or Telegram on untrusted phone hardware?

The short answer is that if the hardware is compromised, then anything you can read, it can read.

No, the device can see anything you can see, so if it's compromised, using encryption wouldn't protect you against that specifically.

When you use encryption, it goes something like this:

1. You type or say something into the phone.
2. This goes through the phone's firmware / operating system to turn you touching the screen, pressing a button, etc. into some key codes, characters, screen coordinates, etc. apps can use.
3. This is then sent to the application you're using.
4. This application then encrypts the data.
5. This data is then sent back to the phone's firmware to send it across the network.
6. Magic happens on the network.
7. The other device's firmware receives it and steps 1 to 5 happen in reverse on that side.

Step 2 would be the obvious weak point as the phone can see it but there is no encryption because the app doesn't even know about the data yet. Similarly, when receiving data, it also wouldn't be encrypted as it's what you're actually hearing or seeing. This is typically where keyloggers reside.

The only ways to protect yourself from compromised hardware would be to have your data encrypted before it gets to the hardware (type encrypted data into the device, which would be a whole lot of effort to do right, or possibly use a trusted device which sends encrypted data to it, which is basically how you normally use encryption to protect yourself from the compromised internet) or to just not use that hardware.

You have to put some level of trust somewhere in the chain. There's no direct way to find out where the backdoor could be. In android device, you may trust OS because of its kernel source but drivers and firmwares are proprietary. If these were flashed in compromised state, it gives an attacker same level of privilege as the kernel.

If the OEM seems to be trusted then the chipmaker can act in bad faith like installing embedded hardware debugger which listens on embedded cables, can host a server and use NIC for internet access. Chipmakers can also install backdoor in primary bootloader which boots SoC and act as root of trust. From there secure boot flow can be compromised down to the OS.

Every SoC comes with Trusted Execution Environment (TEE) which has unrestricted access to the host OS. Compromised TEE can decrypt any secrets for the attacker that it is supposed to protect. It protects encryption key like for the Signal message store, app password, biometric data etc. As it runs outside of host OS it can install debugger in any app to listen app data in memory.

These backdoors are stealthy and unaware to the host OS but if they are not obscure enough, they can be caught.