If the intent was data harvesting, why the hell did they not actually send data that was useful to harvest? If they wanted to harvest data, they would have sent your Apple ID or device identifier along with the app hash.
They didn't.
Either they are just completely, blitheringly incompetent, or: They actually, truly, didn't intend to harvest any data.