If they can install malware on the device, wouldn't it be easier to use something like the accessibility features of Android to just scrape the content or maybe take Screenshots, send them home and use OCR?