Perhaps, make the user override some of the function logic, or make more complex function calls, rather than just adding a Log.d call in de-compiled smali...

Idea is to have user involve with more complex smali programming (Or frida handling if they prefer to use it)

Add hidden activities where the user would normally be unable to navigate through without invasive means.

Setup a question, requiring them to invasive navigate to the target hidden activity.

Likely through frida hooks...

Harder to implement since I would need to setup a backend server running 24/7, though maybe I could have a easy-to-execute simple backend API script to let users run on Localhost?

Goal is to let user spy on incoming/outgoing network traffic on the android application...

Imo, users would probably spend more time understanding the underlying logic behind the password validation and fetching, rather than understanding how to invasively inject logging...

Perhaps, just generate 5 random passwords at the start instead? and compare against a list.

Could also generate 5 constant usernames that map against the generated password...

Add questions where users should check for basic app vulnerabilities.

Likely just a simple static analysis with mob-sf...