This all assumes they trust the git hash is correct and unmodified or spoofed, both of which would be trivial to do. So they might as well just be taking your word for it...
Discussion
This is probably true for every app. Nobody reads tos or the code or understands / cares how the info is handled and who has access to what. Only some developers might and the user trusts that enough devs looked at the code and confirmed that it’s not stealing everything from the user.
It is not true of every app. Bitcoin core has a reproducible build process. You can verify the published binary came from the published source. However I don’t think this is possible for iOS apps due to Apple’s signing process.
No non-dev user is verifying any binary. They will just install and use. The whole verification thing is for a tiny subset of people technical enough to understand it.
You can always build your own Damus, I do. 🐶🐾🫡
Paranoia has to be applied in healthy dosages. Do you trust Apple to keep your nsec safe? What about all the TLS interactions? Do you trust they private key of each site is safe? This list can go on forever……