John564479 This might be rhetorical but does offline/local app actually increase attack surface?
To a certain degree, yes. But the app being offline with no network access will reduce their attack surface, it will not be zero though.
John564479 In terms of fossify, is it possible that the messages app actually sends/leaks data to the developer via hidden SMS messages and/or get a copy of sms?
The possibility always exists. But people would find out about it as Fossify is Open Source and then it would be gone, similar to how Simple Mobile Tools got abandoned by users as soon as it got sold to an adtech company.
The question I would ask: What benefit would the developer have, to get all those sms and data? Would it be worth loosing their reputation?
Check out the Fossify Github and read through their general discussion and issues https://github.com/FossifyOrg
to get a feel how the devs are.