If there were using https it would be keep secret no, with his "Burp" suite of investigation? That look like a sniffing method, not through decompilation - which is pretty trivial for android source.
Anyway that's strange, or the article isn't technically accurate