I've lived in Germany for 7 years and never once have I added a picture to my resume. It's been no trouble in getting interviews and job offers. I work in tech though. So the experience could vary depending on your industry
Generally yes, there was strong demand for software engineers in Berlin pre-covid. It's still there albeit weaker, so you might not find something you want immediately.
As for the visa, there's generally a 3 - 6 month grace period to find a new job that's granted by the immigration office before you lose your status.
Berlin doesn't give permanent residency per se but Germany does. You can apply for permanent residency with Berlin as your home but it'd be valid around all of Germany.
The Blue Card allows you got get permanent residency in 21 months if you speak basic German (B1) regardless of where you studied. And in any case you'll still get permanent residency after 33 months with A1 German
I think that the risk arises from the bad practice of hardcoding any keys in your mobile app. Hardcoding Twitter keys can extend to AWS or say Stripe for example, which can lead to serious security breaches.
This post could be meant to warn developers against using this practice going forward, and like others have suggested, storing third party credentials server-side, making the call on behalf of the client app and then returning the results to the client.