Its most probably not that X has access to your phone. I believe since some older version of android, all apps are sandboxed and there are rules to what they have access to (Android Run Time, SELinux). How this works IMHO is you are using a normie (google) android phone. You have an advertising ID assigned to it (you can find it in the setting under Privacy/Marketing), which is visible to apps, therefore the Feeder app sees it and sells the data of what you are looking at tied to the ID, someone buying it for a campaign on an exchange and uses it for marketing on X, which shows it to you based on that same advertising ID because it can see it also. To avoid 95% of tracking like this, use a degoogled android phone.