Most likely it does what their other apps do: opens URLs in an in-app "browser" WebView, which is then injected with a ton of trackers that have unlimited access to everything you browse in their app.
iOS apps are allowed to add arbitrary JavaScript to any page on any domain, even HTTPS, as long as it's a WebView and not the standalone Safari app.
iOS apps are allowed to add arbitrary JavaScript to any page on any domain, even HTTPS, as long as it's a WebView and not the standalone Safari app.