Well, any app can make web requests for starters. If Facebook/Meta/Whoever wants to exfiltrate data from their app, they probably can. So, the issue on most app

Well, any app can make web requests for starters. If Facebook/Meta/Whoever wants to exfiltrate data from their app, they probably can. So, the issue on most apps becomes limiting the amount of personally identifying data that can reach that runtime in the first place. Both Android and iOS now do a fairly good job sandboxing the filesystem, but both cannot protect against advanced fingerprinting/data processing. Apple can outline acceptable data processing terms in the App Store, but that doesn't stop bad actors from taking data and processing it remotely. In Facebook and TikTok's case, this is almost certainly what's happening - and why the government is the only one capable of holding them in check. The "alternative" is restricting the amount of entropy a user can generate to near-zero, which isn't really useful for app developers. Suffice to say it's an unsolved issue, even with a singular App Store.