It's far worse than just data collection. At least at one point in time Tiktok's client was disassembled enough to reveal that it had a function to download an unsigned binary blob and run it on the device. They're able to bypass app store protections completely...