a novel technique to trick iOS and Android users into installing malicious apps that bypass safety guardrails built by both Apple and Google to prevent unauthorized apps.

So the "safety guardrails" being bypassed are just the restrictions imposed by Apple and many Android devices denying owners the ability to install apps from outside the company stores?

And the installed apps are web apps, running within browsers that those stores already approved?

Um...

It seems to me that the thing being safeguarded here is corporate profit.

(Wasn't Ars Technica known for quality articles in the past?)