First off a few things: I appreciate your nuanced and well-written, well-thought out comments. You are a very smart person, and you are an excellent writer. I agree with what you said about 98%. We could stop here, and we could shake hands, or I could go on to describe the 2% of what you've written that I don't exactly agree with. With your permission, I'm going to discuss that 2%. Please understand that I mean you no personal offense in the following discussion.

First understand that I in no way support ToTok, I don't use it, I have never used it, and don't really care to potentially use it. I have no financial or interest in the company. I didn't even know it existed until I read the NYT article.

I do, on the other hand, have a very deep interest in Online Communities, Apps, Users, Users' rights, including but not limited to privacy, and Company's rights, including, but not limited to not being destroyed (financially and/or reputationally) by media smear campaigns, intentional or unintentional, explicit or implied.

Now you say: "Regarding your Sagan Standard, the extraordinary claim is not
"It has a backdoor because we can't check."
The extraordinary claim is
"It doesn't have a backdoor, it's secure, but no, you can't check that for yourself."

No, the extraordinary claim is the title of the NYT article: "It Seemed Like a Popular Chat App. It’s Secretly a Spy Tool."

Now... here's the thing (and this is where things get really subtle, so follow along closely!).

That title, and all that the article alleges, might be 100% true!

So what's the problem then?

The potential problem looks something like this:

Let's suppose that an app developer in the U.S. does all of the things you say to to, for the sake of security/privacy.

OK, and now let's suppose that a Nation State Attacker --
our guys, their guys, whoever -- somehow subverts the security of the app (Browser/OS/Hardware/Network/? hacks) and gathers the apps' data.

Now... let's suppose that some foreign newspaper, the foreign equivalent of the NYT -- prints a story that our friend, the U.S. app developer -- who did nothing wrong, and tried to do everything right -- is actually gathering data for the Nation State Attacker (foreign or domestic), and thus is a "Spy" tool.

Well guess what! Under those conditions, the story is absolutely, absolutely CORRECT!

Except that there's a teensy little problem...

Call it a lie; call it an error of ommission...

The problem is as follows:

The problem is that this newspaper article's author/authors, being ignorant of the fact that there was NO INTENT of the app developer to have their app used as a "Spy Tool" -- yet that was the end effect, caused by circumstances and actors outside of the control of the app company!

That's scenario #1.

Scenario #2: The law/legal system of the country in question is used to force the intentional engineering of hidden backdoors for the Nation State Attacker, under penalty of a very long prison sentence...

Either way, the paper's story is "correct" -- but it causes a crapload of harm to the application developer, who only wanted to make a dollar by providing an equal-and-opposite value, and never intended for these things to happen!

Of course, if the ToTok developers intentionally engineered security holes while not being coerced to do so (and the NYT could present proof of this), THEN this article is clean, ethical journalism... otherwise the NYT should not have presented it until it had, and was willing to show to the world this proof...

Would you want a story like this to break in some other part of the world, some part where you do business, but some part where you might lack the language/cultural/legal skills to defend you and your company, when you and your company are acting with the best intentions in mind?

I'm not a Christian, but... remember that "Do Unto Others" quote...

That's why we have have Due Process, The Right Of An Accuser to Face The Accused (Cross Examination), and the Presumption of Innocence -- in our U.S. system of Law...

That's why in this day and age, I never assume that 100% of what the media says is true, 100% of the time.

I am sorry, but even if ToTok has betrayed its user trust (and I'm not saying they did or didn't) -- then certainly the U.S. media has, more often than not, betrayed mine...

I reiterate that the burden of proof -- is on the NYT.