Data controller is whoever determines the purposes and means of processing. But one app might be involved in lots of different processing activities, and they might have different controllers.
Clearly, the app developer cannot control for what purposes a third-party social media service might use the data. So the app developer wouldn't be controller for the activities on the social media backend. But the app developer is responsible for sending personal data to the third party service in the first place. And some processing activities might relate solely to the app, not to the social media service, for example analytics or crash reports.
Relevant case law here is the Fashion ID case, where the CJEU found that website operators who embedded a Facebook “Like” button on their pages are data controllers for the data collection via this embedded button, but not for what Facebook subsequentially does with the data.
If the app developer is the data controller for sending personal data to the social network, there would be the question of legal basis. However, this will typically be Art 6(1)(b) necessity for performing a contract with the data subject (providing the core services of the app), or maybe consent. This is not going to be a hurdle.
EPrivacy issues like access to on-device storage are squarely on the app developer – the remote service has no part in that.