Lazy journalism. The two variants showcases exactly how iOS is more secure and how much harder it is to get on the device as well as attempt to extract info.

Few quick points to answer questions outlined here:

1. Android and iOS Variants behaves differently. Due to security measures (as outlined in this post itself) iOS variant cannot actually extract facial recognition data. Instead, it takes photos of user with prompts about shifting their face and blinking etc. The setup here is because Thailand’s central bank requires banks to perform facial recognition to withdraw larger sums of money. By stealing your face in multiple photos, they could build a deep fake of your face to be used in another device later.
2. Due to the way security works on iOS, the iOS variant cannot exfiltrate SMS messages directly. There is simply no permission to do such. Instead, it tricks users into installing a SMS filtering extension “to prevent fraudulent SMS” — this allows attacker to read incoming SMS, but only from unknown numbers. The hopes here is that they could intercept your MFA received via SMS at a later date.

If anyone wants to do the full reading, it is available from Group-ib directly.

And yes, this further cements my thoughts about EU making a terrible move forcing Apple to enable side loading as it adds additional vectors for bad actors to get into a currently much more secure and harder to invade device.