Often I see people installing leaked updates for apps like Gmail which are shared through Dropbox, etc. These would normally not install because they don't have matched signatures, unless something like this vulnerability was used.

pirated apps are still subject to Permissions; they aren't less secure than non-pirated apps like, say, Path.