Simple example: try to use "Login with Google" from within one of those in-app browsers and you will notice Google had to actively detect them and block the attempt because otherwise the app could spy on the login credentials without anyone noticing.
Instagram, Twitter, Facebook Messenger, TikTok.... the list goes on and on.
I am very confident that these companies are breaking GDPR laws left and right on an absolutely massive scale. They are spyware at this point.