I even read that TikTok has its app listen to a port on localhost, and have websites run code that exfiltrates data this way (effectively bypassing privacy protections of your browser).

Oh wait no sorry, that was Meta. In both the Facebook and Instagram apps: https://cybersecuritynews.com/track-android-users-covertly/.