For #1, it seems the president could prohibit most app activity as it collects data until such a time they remove the data collection. For #3, TikTok the app is a content delivery platform, not the content itself.
Since there is data collected and something of value, it seems that although parallels can be drawn between the content on TikTok and the list of explicitly allowed items, the whole of TikTok is something different than the items listed in #3.
(And if those are the only exceptions the powers are quite broad.)
It's also possible that #1 could be interpreted as having been intended to only protect a tight definition of "personal communications" as single-party-to-single-party, not broadcast communications or social media.
#3 is actually an interesting one. Would it prevent the President from being able to stop a ship owned by a foreign national if it was carrying a single CD-ROM of informational materials? What if it was full of such CD-ROMs? What if part of a frozen bank account was going to be used to facilitate the transfer of information? Would not some hindrance of the free flow of information be an inevitable side effect of ANY action under IEEPA? Of course, one imagines it was not the intention of the drafters of the law to let a single CD-ROM neuter the entire presidential power. My non-lawyer understanding is that courts normally establish some kind of "balancing test" in these scenarios that can be used to draw a line in the sand. But from e.g. https://fas.org/sgp/crs/natsec/R45618.pdf it's unclear whether there's any case law that specifically establishes the boundaries. Regardless, this will be a very interesting saga.
Since there is data collected and something of value, it seems that although parallels can be drawn between the content on TikTok and the list of explicitly allowed items, the whole of TikTok is something different than the items listed in #3.
(And if those are the only exceptions the powers are quite broad.)