Both #Yandex and #Meta used obfuscation techniques to hide that the traffic occured and/or that the apps were listening to these requests:
Meta traffic was using #WebRTC, which does not show up in the browser's developer tools
Yandex traffic looked non-local
Yandex apps started listening only after several days
BTW: Apparently, Meta stopped doing this yesterday. But they probably still have the mapping DB.
All the details by the researchers here.
https://localmess.github.io/