While unobfuscated code is really nice to have from a hacker's perspective, isn't this a rookie mistake on niantic's part?
Or perhaps was this a conscious decision, not do to it for some reason?
Or perhaps was this a conscious decision, not do to it for some reason?
Most of the code is inside Unity, which is harder to access, but they ended up putting more code in the Android part (for the Pokémon Go Plus for example), and probably forgot about it.
They can still obfuscate later releases, but the lack of certificate pinning is going to be harder to fix.