Despite using a VPN, an application natively running on an Android device can get lots of information about its host (like hardware IDs or SIM card information) which defeats the whole point of using a VPN with the purpose of anonymizing your activity.
Of course, there are ethical and privacy-friendly by-design applications, but most of them are designed to mine user data.
Is there a way to strictly limit the amount of data an application is able to get from a device or give it random data each time it requests it? Android's native "permission" system doesn't show itself to be really good at regulating the amount of info applications can get about the user. For example, the TikTok application seems to be able to get your location if you are using a mobile network even without "phone" and "contacts" permissions given: My location get recognized by my SIM card