That's very helpful and adds a lot of clarity.

You can tell from the code that the "exploit" here is abusing keychain sharing.

iOS has a feature where you can pack a surprising amount of generic data into keychain storage, intended for passwords or auth credentials.

iOS also lets app developers opt-in to shared credential storage, so that if you have multiple apps, the user only needs to login once. Here's a blog post on how to do it: https://evgenii.com/blog/sharing-keychain-in-ios/

A little-known quirk of the iOS keychain is that it persists across app installs. This is useful because if multiple apps share credentials in the keychain, you don't want uninstalling one app to log you out of other apps.

If an American company tried this (looking at you Branch.io), would it be banned by Apple? Maybe? That seems to be the controversy here.

Perhaps Apple needs to rethink its keychain sharing API and make the user opt-in to credential sharing.

Also a keychain management tool would be nice, so users can see what data apps are permanently storing on their devices (even if the app is uninstalled).