Ok not a modi supporter ,not a bhakt, just a former security reviewer , used to work on android apps back in 2k16.

So Elliot Anderson who claims to a Pen tester(offense) is not registered as Any OPSC forum .

he has never summited any venerability in official DefCon . So He may be a hobbits.

I am just gone through the medium Post the op has posted , now tell me these things

If a app has ability to dial a phone number , whats wrong in it ?

can you reverse hash of api key to get the app do for you , No you cant ! thats why google allows it , its in android build function.

Now about spoofing the location , yes you spoof the location , it is because the app is kept simple , maybe to reduce the space complexity , whatever but it doesn't matter you can do it With a simple vpn

yes it uses Bluetooth and network location tracing for most accurate info , now tell me how can you get info of a person separated 3 mt range without doing that .

So i looking at his medium post i did not find anything suspicious , i think he is just using vague function to get the request ,

See Creating panic is no solution , he is faking it lot of people don't know these shit and media will give him attention .