Re: Let's play statistics!
I've just bothered to read the actual paper that this article is based on. They do identify the baddest apps and yes all the apps they examined were 'free', aka ad-funded. The bad apps are very much a minority of the sample, though not a small enough minority to be ignored.
The majority of URLs/domains are those you would expect from ad-funded apps, i.e. google ads and analytics, doubleclick.net, etc.
The 10,000 user interactions were per app, so lots of user interactions per URL.
The 'suspicious' score in the reg article of 5.6% is a bit misleading, in the paper the researchers identified 94.4% of apps as failing to access any url/domain identified as suspicious by any of 52 different sources. Since there are likely to be a few false positives across those 52 URL rating sources, saying 5.6% accessed suspicious URLs is not really a fair reflection.