The problem isn't in reading, but using the wifi key. The app promises to keep the wifi keys secret from other users:

> "... credentials are added to the database so that everyone else on the app can also use that hotspot. Users cannot actually view these credentials so as to protect user data."

But if a client app can download the wifi key from the server and use it to log in, then a modified client app could also download all wifi keys and show them to the user.

There is no practical way for the server to distinguish the original client app from a modified one as long as the user is in control of the hardware and OS it runs on.