These applications have to read everything you type to be able to see if the expansion trigger is being used. They are quite literally keyloggers.

They may be nice, but you're essentially letting the application read everything you type. Including passwords, social security numbers, anything...

Any type of network access here is unacceptable.

I know you're probably referring to mobile apps. However, I only use a text expander on Desktop, where I can recommend espanso. It's FOSS and doesn't connect anywhere (unless you tell it to). I wouldn't trust a non-open app that can read everything I type.

Why do you use a separate Android app with all of those hostile permissions instead of the built-in personal dictionary and its shortcuts? I have thousands of shorthand lines in Android's personal dictionary, like wdyl = what do you like (type the first part and the second part appears in the autocorrect pane for you to touch if you want).