If you read any of the technical analysis, those claims are clearly unfounded and the hacker doesn't even understand how REST works: http://thenextweb.com/apps/2014/11/27/ubers-app-malware-desp...

As an Android developer, the root and vulnerability reporting behavior is pretty standard for bug tracking, and in Uber's case fraud prevention as well.