The article is pretty clear that the issue is with the Android devices themselves, not with lazy users. There is no indication that a malicious app has these permissions.