Most likely it does what their other apps do: opens URLs in an in-app "browser" WebView, which is then injected with a ton of trackers that have unlimited access to everything you browse in their app.
iOS apps are allowed to add arbitrary JavaScript to any page on any domain, even HTTPS, as long as it's a WebView and not the standalone Safari app.
This is generally worse UX vs. just opening Safari. There have been exactly zero times where I was happy that a link opened in an app's WebView, instead of in Safari or the appropriate external app.
Why does a seemingly privacy-focused Apple create the compromisable WebView system for apps? Is there some weird edge case for apps that they need this, for a non-evil reason?
They don’t allow third party browser engines. If they didn’t allow web view they are effectively banning third party browsers completely. I can’t imagine that would make their anti trust problems any better.
Although, it does seem like they could get more granular in app approval, which I am sure iOS devs would not like, but users would. For example, "If your app's primary use case is navigation of the open web, you may use WebView to handle 3rd party links. However, if that is not the primary purpose of your app, web links must open in iOS."
Either that, or give me a setting for each app, which the dev can set the default on. "Open links in Safari."
There’s a permission for Location at least, “In App Web Browsing” can have that permission disabled. Web Views don’t seem to have similar treatment otherwise, afaict. I’d sandbox them aggressively if I could .
I use Adguard which has a Safari integration that appears to apply to Web Views (based on the absence of ads), though I don’t have proof of that.
Well, just off the top of my head, an epub is basically HTML and is simple to implement with a web view. Nice when the OS has a framework that provides one.
iOS apps are allowed to add arbitrary JavaScript to any page on any domain, even HTTPS, as long as it's a WebView and not the standalone Safari app.