The answer is likely a non-issue, such as some connections not being pinned and possible to intercept if you install a custom root CA on your device.

The submitter mentioned something along these lines, if I understand correctly, in his only other HN submission.