Even after enabling HTTPS the user is not completely safe regarding MitM attacks, because there is the chance of a compromised root certificate store. So of course you can use certificate pinning for mobile apps. But are there additional options to securely transfer the login data/critical data?
... because there is the chance of a compromised root certificate store.
You effectively assume that the attacker is able to compromise the system where the client is running on. In this case it is impossible to protect the client. While certificate pinning can be used to protect against a modified trust store the attacker can still modify the client itself and thus get to the unencrypted data. Examples for this are browser extensions which have access to the plain data but it can also be done with replacing the TLS library linked to the client application or modifying the client application itself.
Like the name suggests: a man in the middle attack is only about a man in the middle and not about a man in the client. Properly implemented TLS protects against man in the middle but cannot protect against a compromised client or server like in your case. And there is no way to fully protect the data if client or server is already compromised.
The approach is to get the certificate as on the running context of the client and then compare it with your original certificate. This is the same approach of certificate pinning if you are developing an app. If you want it for web browser, then you can develop a flash object to do the same or use Forge project: https://github.com/digitalbazaar/forge/