They (or someone working with them) would have had to download the app and inspect it. They clearly tell me that they've detected access credentials in the app itself.

That's not conjecture.