They didn't use an Android exploit specifically, they simply scanned the blockchain for vulnerable private keys. They probably didn't even know that Android was the culprit - it could be hardware wallet, a buggy homebrew client or whatever.