It’s not protected at all, and after reddit crapped out, the dev even released a version with a bunch of security features removed to make it easier for the reVanced team to patch the client so it keeps working with reddit, using your own api keys.
The whole discussion took place on his official support-discord. I was genuinely flabbergasted he was so cool with people disassembling the app, and even helpful in the process.
As for data tracking, it’s possible to log it with the duckduckgo privacy tracker, and I confirmed that buying adfree completely removes any outgoing connections to anything but the respective lemmy instance you’re using.