Firebase auth security certificate pinning/transparency

[Lexycon]

Hello,

I am not 100% in the security topic, but I just did some basic tests on my android app with a mitmproxy. It was simple to use a self signed certificate and read all the https stuff.

Why is there no support for certificate pinning or certificate transparency for this lib? I assume certificate transparency on iOS is enabled by default by the OS, but for android this seems to be a problem.

I mean there are some downsides on pinning which I know, but what is the reason to not enable certificate transparency by default?

Is this not implemented because the developer should enable AppCheck anyway? I assume AppCheck would secure this?