Why two files are useful
Expo configuration contains identity, plugins, purpose strings, and Android permissions. `package.json` exposes direct dependencies that may introduce data flows or store duties.
An auth, purchase, or analytics package is not automatically a defect. It prompts a check of sign-in alternatives, deletion, in-app purchase rules, App Privacy, and Data Safety.