Running inside the app is probably the strongest argument here, though I think that's also kinda assuming that people cannot subvert the app in unexpected ways.

Running inside the app is probably the strongest argument here, though I think that's also kinda assuming that people cannot subvert the app in unexpected ways. The size of requests can still be observed e.g. being on Wifi - people don't just use their Smartphone from the cellular network. My thinking is that while in this case it's "probably safe" to use Gzip + HTTPS, but that's not a good practice to build secure systems. If e.g. here these requests are exempted and run to Gzip, the reasons and circumstances for doing it here will be forgotten, and can end up with other stuff exempted later which shouldn't. Just from experience how things work in large orgs.