Note: I don’t quite know how the decentralized internet is working so terms may be ambiguous.
When trying to sign-in to an app, would it be possible to make a button to find and connect a users username to their ID-XX…XX if it is not showing up connected to the ID-XX…XX.
My thought is along the lines of type in your “username.” It searches explorer or registrar and if the ID-XX…XX’s match, the username is propagated to the storage spot that the app is using to pick your identity.
My thought on hacking this is sending a false ID-XX…XX with the username find request (to the explorer/registrar) so the hacker can obtain someone else’s username on their ID-XX…XX.
I also don’t really know how that hack would work.
What is the question exactly? 
Apps can be designed to both use the username and the underlying Blockstack ID address. For name resolving, it’s a lot easier for solving usernames into addresses and then use those, though.
The only way a hacker could “hack” this system would be if the app used the username only and not the underlying ID, and then the hacker bought the username before the previous owner renewed it.
To understand more of how it works I definitely recommend reading the whitepaper (https://blockstack.org/whitepaper.pdf); it’s pretty easy to understand!
My question/request was based on a misunderstanding of the username acquisition. I thought that acquiring the username just meant it needed to propagate to all the necessary locations, but instead it seems someone needs to mine a block that the username is saved to.
Correct - name acquisition, renewals, and transfers are all set in stone via the underlying blockchain.
Glad you could figure it out!