To follow up — someone unbundled the Android APK and confirmed that it does not use certificate pinning.

https://applidium.com/en/news/unbundling_pokemon_go/