This is probably true for every app. Nobody reads tos or the code or understands / cares how the info is handled and who has access to what. Only some developers might and the user trusts that enough devs looked at the code and confirmed that it’s not stealing everything from the user.
Discussion
It is not true of every app. Bitcoin core has a reproducible build process. You can verify the published binary came from the published source. However I don’t think this is possible for iOS apps due to Apple’s signing process.
No non-dev user is verifying any binary. They will just install and use. The whole verification thing is for a tiny subset of people technical enough to understand it.