I mean, if that’s the question you want answered…
X uses a native browser controller when you open a link, so the app can’t see what you do in there.
Whereas TikTok uses a managed webview… which they have been caught injecting keyloggers into.
Back in the olden days, we called this a cross-site scripting attack.