Because the "evil app" is just a specially crafted JPG that your browser opened up that triggers some edge case in the old unpatched version of Wireshark that is inspecting traffic.

Wireshark (usually) runs in promiscuous mode; it'd be "an evil app is already able to send something visible from your network interface" - which to be fair, might help for internal uses. It does usually mean that anything on your local network can attack you.