That source looks better indeed.

Ars quotes nonsense like “bypasses the security” and “exploit the user”.

Those terms have meaning and they aren’t applicable here.

At the end though they do say things like

is able to hack your phone from the moment you install the app

Without any credible evidence.