Certificate pinning is bypassed routinely, and not because the cryptography is weak. Why the check is the target, the two operational failures, and the four controls to pair it with.
Android carries more threat activity for structural reasons. What makes the platform different, the six Android-specific attacks, why ProGuard is only layer one, and a practical priority order.
A decompiled app reveals your API surface, secrets, business logic and security checks. Here is exactly what is visible — and what mobile app hardening changes.