By my reading of the article the attacker gains access to user's Starbucks account, adds another card and transfers money to it. It doesn't appear to involve the mobile app at all.

The real problem seems to be with the lack of rate-limiting of the auto-reload feature.