It has features that regular users really, really like. Not having to associate the account with a phone number, scheduled messages, groups/channels with thousands of users, the ability to program bots, silent messages, editable messages, ...
Some people care more about these than security or privacy. It's that simple.
As for monetization, I believe they have premium stickers and such.
I think the irony is that so many attack Signal for pursuing more features. While they aren't features I personally care about I do recognize that I can't have secure communications with people that are unwilling to use secure means of messaging. While I want anonymous identities (not actually usernames akin to what we have here) I do think the social graph is far more important. Not that you can't work on both at the same time (though Telegram and WA have significantly more developers)
Some people care more about these than security or privacy. It's that simple.
As for monetization, I believe they have premium stickers and such.