Data harvesting is half of the problem. I have a feeling that congress could give two shits about the data harvesting as it’s almost literally everywhere in modern society and not in the interests of donors or the nationality security apparatus to remove.
The other half is the platform and its potential (hypothetical and actual) for use in information operations. TikTok has direct access to something like 160 million American devices. That rivals other social media giants like Meta who have some government liaisons and relationships embedded in their security teams. ByteDance to my knowledge does not have these relationships. This problem could just as easily apply to any other foreign platform if any were large enough to pose threats of this scale.