Reading that report more closely, it appears that the app has many characteristics the analysts considered suspicious but there's no evidence that it can actually bypass OS-level restrictions. The report is from September 2023 so if there were actually Android bugs that allowed permissions bypass I would have expected more security reporting from Google or third parties by now.
https://grizzlyreports.com/we-believe-pdd-is-a-dying-fraudul...
Reading that report more closely, it appears that the app has many characteristics the analysts considered suspicious but there's no evidence that it can actually bypass OS-level restrictions. The report is from September 2023 so if there were actually Android bugs that allowed permissions bypass I would have expected more security reporting from Google or third parties by now.