For determining what's used in shipped games (e.g. if you want to check that your extension DLL/code is used by the game) and to understand what information is exposed in your own builds.

• [Android] .xapk/.apk/.so can be traversed with 7-Zip
• headers can be inspected with any hex editor or often even Notepad (most <500KB files only, Notepad may struggle to open bigger files)

• in .unity3d file header
• in resource file headers, for example:
  • unity default resources
  • globalgamemanagers
  • level<number>
  • sharedassets<number>.assets
  • files with 32 characters long names using hexadecimal characters [0-9a-f]
• [Android, since 2017.4] lib/<arch>/libunity.so/.note.unity
• [Windows] <executable>/.rsrc/version.txt
• [Windows] UnityPlayer.dll - Properties / Details / File version

(methods that work even with IL2CPP builds)

• [recent versions] ScriptingAssemblies.json
• search for .dll in global-metadata.dat with a hex editor

Use cases:

• can determine URP usage by looking for Unity.RenderPipelines.Universal.*.dll (e.g. Unity.RenderPipelines.Universal.Runtime.dll)

• In non-IL2CPP builds, all code that made it into a build is also available to the end user and can be viewed with various tools (e.g. dnSpy for .dll files) relatively easily. Obfuscation can partially mitigate it, however the most effective obfuscation methods (runtime assembly generation/loading and other methods relying on JIT) are not compatible with IL2CPP so wouldn't be used by extension developers.
• global-metadata.dat appears to contain all the method/property/field names in UTF-8 (or at least those that were used and not stripped) from all the assemblies that were used by the build.