It sounds like they're doing at least some reverse engineering via the Xposed framework, which requires root. However you could probably get similar findings by just sniffing your own network traffic.
Modern iOS/Android have something called SSL Pinning. Which means if you want to use a self-signed cert to Man in the Middle the HTTPS traffic it won't work. So you need to patch the network stack to allow this. I have a spare iPhone I keep rooted for this reason.
(I know things like Google Apps and such use it, but I'm not sure about less popular ones)
Rooting the device enables you to put custom certificates in system store, and bypass this check.
That said, it is more convenient to have a spare rooted phone.
Yep, the mobile OSes have that option, but it’s not very commonly used. I fairly regularly snoop traffic on apps and it’s not super often that I’m blocked temporarily by cert pinning.