But the malware was encoded as an image, how is it runnable on the target's smartphone?
The purpose of command and control servers is to send and receive data to victims devices.
A secondary goal is to do so while evading detection. This is why many threat actors piggy-back off of legitimate services, it disguises the malware communications and avoids directly exposing the upstream C2 instance.
The author basically found a creative use of Hinge’s infrastructure and proved it could be used to control malware.