The key problem is, Android is a front-end technique. Everything you put in code/resource is transparent. But so many developers treat it like back-end and believe it's save to put sensitive info inside...
Being silly with you credentials can hurt you, regardless of the platform or using a compiled or interpreted environment.
This isnt as much a "vulnerability" as it is a complete miss understanding of security and the technology they are using. Everything on the client side should be assumed as obtainable.