But what can they do with it?
I'll bite.
Say it's a payment app.
They can track every transaction you make, report oddities to the IRS, flag you for an audit. They can drain your account. They can blackmail you when you buy flowers for your mistress.
Get it?