Obligatory mention for those who don’t know yet : you can find what files a program use by using strace <command> (provided strace is installed). It actually logs all syscalls made by the program, so there will be a lot of noise, but in there you will find the access() and open() calls.

Additionally, if you want to strace programs that already are running in a convenient interface, htop has strace support (this is less useful to find configuration files, as those are usually read at the start of the program, but if you can trigger a save to the file, it will appear here).

It’s often not up to the app. It can be up to the packager, the distro, or the user if they change the XDG config directory.