As mentioned by someone else, they just need to take the phone of a demonstrator to access their signal groups.

https://freedom.press/digisec/blog/new-leaks-on-police-phone...

True, physical interception is probably the easiest method, at least for short term access. Once the captured user is identified and removed from the group they will lose access though.