The OP on V2EX mentioned[1] that they downloaded QQ from the Microsoft Store, specifically because it doesn't come with QQProtect. Didn't help, apparently.
There's a fatal issue with Microsoft Store apps: it allows both sandboxed and unsandboxed apps, and the developer can just upload a new version for their sandboxed app, that is not sandboxed. Updates are automatic, so the app, that looked like restricted to access only say calls will after update be able to access anything it wants.