Not sure how these particular scanners do it, but during security assessments you sometimes use tools that will find all strings in an application package with high entropy.

Usually its junk, but occasionally you do get lucky and find tokens.