Hi!

Great article, but a bit confusing for me.

You are presenting a technique to protect data from user input, and this data is not threatened by reverse engine attack (because they are not contained in the apk from the beginning).

Manifest, build.gradle, string.xml are places to store predefined data, so it's completely different.