Signal only allows the "Admin" to add users to a Group. Mike Waltz was the person who set up the Group. That means he was the Admin. Could Waltz have assigned a SECOND Admin? That is possible, but there was no mention of that in any news I saw.
And, again, the Journalist FIRST had to be INVITED into to the Admin's list of trusted Contacts. But there is one more thing: Waltz, as the person who set up the meeting, ought to have looked to see all the members of the group before calling the meeting. It's implausible that Waltz is both innocent and competent.
Only the fact that all the signs point to Waltz gives me any reason to suspect that Waltz may have been set up in some way. But that isn't sufficient reason to keep him.
Could he have incompetently left his phone, with classified information, lying around? Of course. How does that absolve him?
Anyway, as you said, Trump's decision -- and Trump has decided that Waltz gets a sinecure as Ambassador to the UN, but not fired. At least not yet.