Sure that is easily possible. They can also push an update to everyone and a slightly modified version the same time only to certain devices.

In fact if this is still true then Google could even dynamically push a exploit into Signal without an update to the app itself.