We're thinking about Bluesky as both a product and a protocol (informing each other's design), and you're 100% right that for the end user, the product itself is what matters. Because we've taken on the decentralization constraint, we take longer to "catch up" to features that centralized platforms tend to have from the start, but it's definitely going to be a major area of focus for us going forward. (Ofc Mastodon isn't centralized, but note that it's had a few years of head start on feature development. We'll get there.)
For a decentralized protocol doing things right is much more important than doing things fast, it is very difficult (and in a lot of cases impossible) to break backwards compatibility.
If Signal releases a malicious update (and they don't provide reproducible builds), it is very much possible for you to know about it, as everything is on your device. Even if the binaries are different from the source code, decompilers, analyzing network traffic, etc. gives the community a good chance at catching malicious updates. Mastodon admins can simply pull up your plaintext DMs on their servers and no one will ever know.
Videos might be more of a resource issue. Hardly a good time to launch videos almost at the same timeframe as they spike their user base by going public.
