It's also possible they didn't listen to their app over the wire and see it doing this. What lesson could we teach about "why you should mitmproxy your app while it's in development?", so that people can start uncovering this in other apps — including their own?