The native code used by iOS apps has to follow Apple's App Tracking Transparency privacy framework. Thus, all the data tracking and collection happening within the iOS apps is approved by the user. However, in cases where the apps open external links to third-party websites, it is a different matter altogether.
There are two primary factors that can be a source of concern:
Custom-built In-App Browsers
WKContentWorld
Custom-built In-App Browsers
Generally, iOS apps open third-party links in the user's default browser. Or, they can use the SFSafariViewController, which is approved by Apple, to open websites within the apps. Both these cases are safe for the user's data privacy, because they prevent the iOS apps from monitoring any user actions happening on the external websites.
But, if an iOS app is using its own custom-built inapp browser, then it is within the power of that app to inject JavaScript code. Once this potential for code injection is left open, it becomes a possible source for malicious or illegal data tracking. Note that the addition of such JavaScript code can be done only by the developers of those iOS apps.
This extra JavaScript code can include tracking of keystrokes, tapping on-screen, elements selection, scrolling etc. Thus, it leaves open the possibility that some iOS apps could exploit this loophole to track and collect user actions data on external websites. Technically, such monitoring of user activity on third-party websites is no different from keylogging and spying. That's why this issue is worth highlighting and solving.
WKContentWorld
As we will see in the next section, it is possible to detect and figure out if any iOS app is injecting JavaScript code that monitors user actions. We can do that using an open-source project called inappbrowser.com. However, even such detection can be hidden by the iOS apps, if they choose to use WKContentWorld isolated JavaScript system. This method essentially separates the environments where any code is running. The inappbrowser project is unable to detect any JavaScript code injection if the iOS app is using WKContentWorld.