The definition of malware in that article is quite broad, and includes apps which are just 'collecting and sending GPS coordinates'.

Even if one of the apps I've installed from Google Play is malware (by the definition in the article) it doesn't mean my phone is 'owned'. An attacker can't run arbitrary code on the device or get copies of my data or send texts pretending to be me.