A weather-forecasting app from TCL Communication Technology Holdings—maker of Alcatel smartphones—asks for data beyond what’s normal for a weather program, a security firm says.