1) The app communication is using HTTP.

2) The attacker has some means of executing a MITM (man-in-the-middle) attack.

The portion that appears to be unique to iOS (maybe it's not), is the default cache policy for 301 redirects. Specifically, once the attacker has targeted some HTTP traffic, they use the MITM attack to redirect iOS to the attacker's server instead of the intended one. The default cache policy on iOS makes this redirect more or less permanent. That's bad because once you leave the compromised network, your phone will continue to talk to the attacker's server instead of the intended one.

The reason this exploit is seeing such an apathetic response is because the cache poisoning is pretty lame in comparison to having executed a MITM scenario. Once you have MITM, you have complete control over the traffic a device receives. For HTTP communications, this is not specific to iOS devices.

The best mitigation for MITM attacks is to simply use HTTPS instead of HTTP. Unfortunately, it's not easy for iOS users to see whether an app is using secure back-end communications.