I see a screenshot of normal app startup, some random wireshark requests, some traces of what looks like a login/account system and some localization strings. The de-minified Javascript in the screenshot that author claims he could "clearly see the data was being exfiltrated" looks to me like a random Icon with some attrs. How is this relevant to exfiltration?
(Side-note his claim that he "performed a MITM attack to capture this iOS specific data" sounds more sensational than it actually is. He just put a transparent proxy in the middle, and didn't really attack anything)
The iFlytek stuff could be relevant and is interesting but there is so much noise, big headlines and "read my full report", that it feels to me the author tried very hard to find anything to post
Not saying the app is innocent. It's important to look more into what it's phoning home, but this is just the impression I got from reading through it. Maybe the full report will have some more solid findings in it. Still very cool that the entire decompiled source has been uploaded, that will get more curious eyes on it