Well - either stuffit/someone who hacked stuffit cleverly infiltrated one of the base browser protections against downloading files without an interaction acros

Well - either stuffit/someone who hacked stuffit cleverly infiltrated one of the base browser protections against downloading files without an interaction across multiple browser implementations but forgot your phone can't run programs in dmg format leading them to a dead end of infiltration... or your phone registered a tap you didn't desire it to. (all assuming the dmg was for stuffit, it's possible the file just came from elsewhere if not)