pull down to refresh

This attack certainly didn't require AI. It's just grossly neglegent enginering, plain and simple. Not even borderline.

The vulnerability looks like it was purposefully built-in. NVK will have known about it for a long time, and there's a fair bit of chatter about it on security blogs.

Also, I would use 'back door' instead of 'bug'.