Agreed. From a privacy perspective, it is a lot safer to run the app in an environment where you have admin control. E.g. disable when not in use, block access to sensitive device information, limit background and network activity as much as possible.
That is not entirely correct. The reported found the app using permissions that are not covered by the manifest. It also found the app being capable to execute arbitrary code send by temu. So it cannot be clearly answered if the app can utilize these permissions or not. Obviously they would not ship such an exploit with the app directly.