Sounds to me like it detects the activity to activity transition (which on Android creates an Intent which is passed to the system and back via shared memory) and then does something else, i.e. display a fake password entry screen when the transition is detected.
It sounds like the actual Intent contents remain secure, however, the creation of an Intent while a particular app is in the foreground and using a particular amount of memory might be the kind of trigger they'd be looking for.
An OS level patch to get around this could involve preallocating shared memory for each application so that differences in it during the app lifecycle do not actually occur. Modern systems have enough RAM, and there are low enough limits on what is flying around, that this shouldn't be a problem.