To answer my own question - the in-browser keylogger story was concerning to me. If it was actually transmitting the within-browser keystroke data back to tiktok servers, that would be quite concerning... except that I already avoid their browser like the plague because it sucks, so I just retype URLs into my default browser in the rare cases I want to follow a link in someone's profile.