[est31]

The permissions of the app are one thing, whether the app does it is another. In theory what you say would be possible, yes, but does the TikTok app have a feature which allows remote enabling of the camera, i.e. without user interaction? The code is public and can be decompiled. TikTok is not in charge of application distribution either, Google is, so if they add such a feature, people might notice.

[kindle-dev]

Modern apps are obfuscated and use certificate pinning to avoid network traffic introspection. It's really not simple to decompile an app into something understandable.

[BelenusMordred]

https://github.com/shroudedcode/apk-mitm

Removes certificate pinning from apk files for mitm inspection.