Microblog Memes

In iOS, sure, just give me the app source code and... oh wait, the compiled apps from the store are also obfuscated, guess I can't search the code for you.

On Windows though you can look at what process runs when you click "update and restart" in Firefox or Chrome. Both have an updater service that is just there to run an update exe with admin permissions. Both could be used for the same attack vector you're afraid of. Every {softwarename}_helper.exe is the same thing.

Chrome on iOS can execute javascript and has a history of vulnerabilities using that code execution, so much so that I even had to use the browser to jailbreak once, so I am not sure what point you're trying to make other than fear mongering. You also still haven't addressed the fact that the code execution is still sandboxed. Any app that uses electron can download a zipped bundle of code and run it as well. Also any app with a built-in web browser is allowed to do this

But you can also just look at Bloons TD 6 and their "downloading new content" windows when the game starts.

Let's also look at the comment from the reddit thread you originally linked.

Phone hardware (cpu type, number of course, hardware ids, screen dimensions, dpi, memory usage, disk space, etc)

Yeah that's pretty normal, even javascript can get that just to render a page. I don't like that it's normal, but none-the-less

Other apps you have installed (I've even seen some I've deleted show up in their analytics payload - maybe using as cached value?)

Yeah this is normal too, and imo a huge issue. On windows there's even an unprotected API for it. Again, I don't like it, but it is normal.

Everything network-related (ip, local ip, router mac, your mac, wifi access point name)

Sketchy as hell, I agree, but every app you give local network access to does the same, so we should ban Messenger too.

Whether or not you're rooted/jailbroken

Every banking app and Pokemon Go do this. This one can be very dangerous if you're jailbroken.

Some variants of the app had GPS pinging enabled at the time, roughly once every 30 seconds - this is enabled by default if you ever location-tag a post IIRC

Normal for social media. Shitty, but normal. We should just ban this feature

They set up a local proxy server on your device for "transcoding media", but that can be abused very easily as it has zero authentication

As does Adobe Premier Pro and Final Cut. Sketchy again, but maybe we should just ban proxying without notifying the user.

Edit: The source your reddit source gave is agreeing with me. https://www.zimperium.com/blog/zimperium-analyzes-tiktoks-security-and-privacy-risks/

Over the last few months, we’ve analyzed top banking apps and top travel apps, related to security and privacy issues. Much like TikTok, some of the results are alarming

Their other source appears to not do anything and gets "suspected phising" warnings on firefox https://penetrum.com/research/