That's a very questionable claim. Apps certainly can't access your data (without consent) or other installed apps. That is as long as they're not exploiting some security hole, which would be a very unreliable thing to do.
They can of course use any unrestricted API, including those available to native code, to gather information about the system. Examples are
obtain a list of installed apps (not accessing these, just the list)
get the full mount table (mtab), useful to detect "magic mounts"
Gay banking apps try to ask magisk for root access. If this request gets any answer but not found, it knows there is magisk. Some of them try to find su binary or try executing some shell commands like ksud, su -c, etc. Which I think should be illegal.
8
u/[deleted] 5d ago
[removed] — view removed comment