Going to toss out the “hybrid warfare” buzzword (buzzphrase?) here. This is something that could be done in a way that’s inexpensive economically and, because it’d be hard to prove conclusively, without much risk of political repercussions.

If it’s happening now (which is a very big “if”), the capability isn’t wasted unless they overplay their hand and the app gets banned either because the malice becomes apparent or the damage is significant enough that intent doesn’t matter. There’s also the possibility of opsec failure or defectors giving up the game.

Holding on to it until they’ve got soggy-booted PLA troops on the beaches of Taiwan would not be the best move in my opinion. I’m not exactly sitting in on either side’s strategy meetings and don’t expect an invite any time soon so take that with a generous grain of salt before moving on. At that point, it may be easier for voters and their representatives to get behind a ban (possibly as part of a sanctions package) which would limit the amount of damage they could do moving forward. Starting early works in their favor.