[Xiaomi Mi A1 Questions & Answers] billysam:
The app is self upgradable, means that it will not require my consent to check from time to time and update itself just like google apps in the device. hence the background/foreground usage and cpu time.

the app is secured with md5. and every time it is installed/upgraded/updated/removed, the server checks for the official md5 signature of the apk file. as far as I last checked they also enabled https on their servers so less possibility of it being hacked and exploited by hackers.

Its a 100 percent analytics app that tracks Usage activity and improve overall experience(I can see that in the app's code), only if you allow it in the first place. I found nothing to suspect that it's leaking my data in the source code. No leakage, but collecting data with my consent to improve user experience, sure it does, how? by catching thrown exceptions and errors and sending those in logs. since logs have private info as well in them, they mentioned it in their disclaimer, unlike some others where they don't even care to tell you about this.

Here's the android manifest from the file you provided. I can see they last updated to version 1.1.1 on august 30, 2017. so yes, they were installed/updated/run without your consent and installed again if you tried deleting, force stopping, clear data, and came back with updates as long as you're using official.

<?xml version="1.0" encoding="utf-8"?>
<manifest
xmlns:android="http://schemas.android.com/apk/res/android"
android:versionCode="20170830"
android:versionName="1.1.1"
package="com.miui.spock"
platformBuildVersionCode="22"
platformBuildVersionName="5.1.1-1819727"
>
<uses-sdk
android:minSdkVersion="14"
android:targetSdkVersion="23"
>
</uses-sdk>
<uses-permission
android:name="android.permission.INTERNET"
>
</uses-permission>
<uses-permission
android:name="android.permission.ACCESS_NETWORK_STATE"
>
</uses-permission>
<uses-permission
android:name="android.permission.READ_PHONE_STATE"
>
</uses-permission>
<uses-permission
android:name="android.permission.READ_PRIVILEGED_PHONE_STATE"
>
</uses-permission>
<uses-permission
android:name="android.permission.ACCESS_WIFI_STATE"
>
</uses-permission>
<uses-permission
android:name="android.permission.READ_SYNC_SETTINGS"
>
</uses-permission>
<uses-permission
android:name="android.permission.PACKAGE_USAGE_STATS"
>
</uses-permission>
<uses-permission
android:name="android.permission.WRITE_SECURE_SETTINGS"
>
</uses-permission>
<uses-permission
android:name="android.permission.WRITE_SETTINGS"
>
</uses-permission>
<uses-permission
android:name="android.permission.RECEIVE_BOOT_COMPLETED"
>
</uses-permission>
<application
android:label="@7F020000"
android:name="com.miui.analytics.App"
>
<receiver
android:name="com.miui.analytics.AnalyticsReceiver"
>
<intent-filter
>
<action
android:name="android.intent.action.BOOT_COMPLETED"
>
</action>
</intent-filter>
<intent-filter
>
<action
android:name="android.net.conn.CONNECTIVITY_CHANGE"
>
</action>
</intent-filter>
</receiver>
<receiver
android:name="com.miui.analytics.internal.ApkReceiver"
android:exported="true"
>
<intent-filter
>
<action
android:name="android.intent.action.PACKAGE_ADDED"
>
</action>
<action
android:name="android.intent.action.PACKAGE_REMOVED"
>
</action>
<action
android:name="android.intent.action.PACKAGE_REPLACED"
>
</action>
<data
android:scheme="package"
>
</data>
</intent-filter>
</receiver>
<service
android:name="com.miui.analytics.AnalyticsService"
android:exported="true"
>
<intent-filter
>
<action
android:name="com.miui.action.ANALYTICS_SERVICE"
>
</action>
</intent-filter>
</service>
<service
android:name="com.miui.analytics.EventService"
android:exported="true"
>
</service>
<service
android:name="com.miui.analytics.internal.WakeupService"
>
</service>
<service
android:name="com.miui.analytics.internal.JobSchedulerService"
android:permission="android.permission.BIND_JOB_SERVICE"
>
</service>
</application>
</manifest>

I see no permission for camera, mic, contacts, read messages, make phone calls. that's more than enough for me to trust it as safe.