From a quick glance of the paper this attack seems to exploit any app that has the necessary privilege.

My guess is even stock Android has to have at least some of these priviledged apps, but the more you have the greater the risk.