Is there a way to prevent an app from leaking data put like this, e.g, some kind of sandbox disk where files written with one app cannot be accessed by another app (until the user allows it - like photo sharing etc)?
Android has this but it works on the app authors side. Each app has its own private storage space where other apps and even the device owner(!!) can't access. There is then a shared /sdcard folder which apps must request permission to use (Access device storage). Tiktok is requesting this sdcard folder access and dropping trackers in it. Android does allow you to deny this permission but the app will probably require it to share images (Even though I'm pretty sure android provides a ui for sending images without storage access)
This would be enforced in the next version of Android IIRC. If you happen to have a rooted device and trust closed-source app you can also try Storage Redirect ( https://rikka.app/storage_redirect/ )
