They could verify the server's certificate. Even if the user installs a new (trusted) certificate - as in this case - the app could still check the certificate information (fingerprint, domain name, O, etc.).