The short answer is that it depends on the application's implementation. Certificate pinning is not a default, it is rather a custom implementation. Default is to rely on system trust store - on iOS as well as Android.
In general the security best practice is to use SSL pinning. Pinning could be implemented in two ways - Including the entire certificate store to the client package or by including the signature for a certificate to the client package. You shall be able to verify this by reversing the client package.
Similar to the way most desktop applications work, mobile applications also by default rely on the trust store provided by the operating systems. On Android OS's before Android 7.0, the user could install a custom certificate to the system trust store from an SD Card. This resulted in trivial MITM attacks and the capability has since been removed from later versions. Applications no longer trusts user installed certificates on android devices.