Yeah, there are endless holes unfortunately with IPC. It has been hardened by more recent android versions https://developer.android.com/guide/topics/manifest/queries-...

but even something like "share via Chat app" can be used to leak information, e.g. it will have the link preview loaded".