Selfhosted

This too would likely require compromising at least one of the devices or at the very least compromising both users' ISPs or some other fairly detailed and highly targeted attack, but none of that would require compromising Signal's servers and would make any system's key exchanges vulnerable, even self hosted systems.

Simply compromising Signal's servers might allow disrupting key exchanges from succeeding and thus making it impossible for those users to communicate at all, but not MITM really, at least if we assume there aren't defects in the client apps.

The key exchange is much more complex than something like TLS and designed specifically so that the server can't interfere. With true e2ee the key never passes through the server. This isn't like many other apps that say e2ee, but really mean end to server gets one key and server to end gets another and decryption and re-encryption happens at the server to allow users to access older messages on new devices and stuff like that. Signal just connects the users to each other. The apps do the rest.

They could probably do something if they totally took over the entire Signal network infrastructure, but it's definitely not something they could do undetected. But if a government took over the entire infrastructure, security conscious people would stop using it immediately thus not really worth the monetary and political cost. Otherwise China and others would have already done that to all secure communications. And again, not Signal specific.