It depends on the app, of course, but most (citation needed) major apps use HTTPS.
Facebook talks about this specifically:
... virtually all traffic to www.facebook.com and 80% of traffic to
m.facebook.com uses a secure connection. Our native apps for Android
and iOS have long used https as well.
It is still possible that the TLS connection could be broken by MITM, but there is a process called Certificate Pinning that helps to prevent that. Fewer apps have this turned on. In the quote from Facebook above, which was in 2013, they said:
We're actively testing pinning in Facebook mobile apps and plan to use
it in browsers as well.
So, is it possible that your app credentials could be sniffed from the network? Yes. But many apps use TLS and Certificate Pinning to make this unlikely. You need to investigate each app to determine what they use.