This situation is the same on Android, presuming you do not have a rooted device. On Android >7 third-party apps do not trust user certificates by default, and a non-root user cannot install new system certificates. And afaik there is nothing stopping them from using custom crypto libraries that do not use the system roots at all. And of course, even if you could decrypt the HTTPS traffic the actual API payloads and endpoints need not be in any kind of human readable format.
reply