In the embedded world, people rarely run full GNU userland utils. They're extremely big and bloated, and embedded devicse needs maximum bang for buck. Therefore most of them comes with busybox, which besides being incredibly compact also is 100% unaffected.
Same goes for Android/Linux-based phones. Most don't come with a proper shell at all, and those who do, usually have busybox.
If this is true, there's been a fair amount of paranoia on HN that has gone sadly unanswered with corrections.
Actually it's primarily Linux because /bin/sh is pointing to bash.