I don't think I need a citation to say that it's feasible for China to inject malware via the TikTok app on people's phones. Would it be difficult? I imagine so. But, I think the risk is such that the onus is to prove that it's not possible, not the other way around. China is a hostile power and an authoritarian regime. It's a different risk calculus than Facebook, which is not controlled by a dangerous foreign adversary.