Okay, can't sleep, so: 5) The whole point of this proof-of-concept seems to be to have unsuspecting, innocent devs who build regular boring apps, like Tinder F

Okay, can't sleep, so: 5) The whole point of this proof-of-concept seems to be to have unsuspecting, innocent devs who build regular boring apps, like Tinder For Dogs or whatever, unknowingly build the app using poisoned XCode. That way, when Mr. Bad Guy eventually installs Tinder For Dogs on his iPhone, the CIA gets a secret backdoor to his entire phone. But this seems so overly complicated! If the CIA already has a payload that phones home, why didn't they just build their own apps? Why rely on poisoning a dev environment in the vague hope that Mr. Bad Guy will someday download this particular app? What if Mr. Bad Guy doesn't even have a dog? Also, I wrote above that an intelligence agency would not likely be interested in getting data from something like a single-player game. There's probably nothing useful to learn about there, other than Mr. Bad Guy's high score. But maybe that dumb game was the Trojan, not the target. Mr. Bad Guy may be too smart to use SnapChat, but perhaps he installed FarmVille or Angry Birds to while away the hours...?