Even so, I don't see how you exactly you go from internal storage to loading malware or exfiltrating passwords. Exposing internal storage doesn't let you access

Even so, I don't see how you exactly you go from internal storage to loading malware or exfiltrating passwords. Exposing internal storage doesn't let you access the isolated app storage where private app data and passwords would be stored, only common areas like downloads and media. Lacking any technical details, this article reads like one of those scary chain forwards.