MITM? You don't need to MITM something that isn't even encrypted... anyone with a modicum of technical ability can use WireShark to grab these files if they're transmitted over public Wi-Fi. And probably cellular connections, too.
Exactly, sit outside the police station/wherever just nearby spin up wireshark in monitor mode and you have a stream of personal info on the owners of those scanned phones
But they aren't transmitted over public wifi. They are transmitted inside of some kind of private network, given that they are transmitted to a server in the 192.168/24 range
You can have servers with an IP in that range available on public WiFi, no problem at all. If the network is not public, whoever installs the app still needs to connect to it, so you can intercept any credentials they enter, or even run Wireshark on the device.