Or it is a mandated backdoor, and someone internally objected, and made it easier to exploit than it should be, or leaked how to exploit it?
Probably one from the repository of backdoors "accidentally" introduced or "never" discovered.
The mechanism's there, just needs to be woven with other exploits.
Rogue employee employs the backdoor for a major app with hopefully conscientious users who’ll report it online; hopes to force a fix.
Or it was a social experiment and some dumb app reinstalls itself every day too but no one’s complained en masse yet! ;)