I'm guessing this only affected Android devices? But did those devices have the "Allow apps from unknown sources" option checked?

I feel like there's some pretty pertinent technical details missing from the story.

(Or am I missing something?)