Yep. There was a report about how all in-app browsers can do this, and that FB/IG/Twitter/etc. all did it. But, of course, saying TikTok does it gets the clicks.
Reports I read said that while they all inject code, TikTok was the worst, injecting code that intercepts every key press and click.
On iOS at least there are more restrictions of using SafariViewController vs WebView. I could imagine Apple making a policy change to force towards that stricter surface.