Also just for the record, here are the relevant statements I made personally about Decoy:

The "decoy" pictures are indistinguishable from any other picture on your or your recipients' camera rolls

Which, by request I clarified:

Without the password, even a skilled attacker cannot confirm the presence of any metadata.

[I]n terms of image quality, the picture is indistinguishable from any other compressed image.

An attacker cannot confirm your image is a Decoy. They can raise their confidence that steganography is taking place.

These clarifications were provided very early on in the conversation. It has since devolved into a criticism of steganography in general, which at no point have I ever tried to insinuate that steganography is anything other than security through obscurity.