This is one of the most biased and ridiculous flaws I have seen someone come up with. If you were to participate in any kind of bug bounty and report these flaws, you would have been immediately disqualified for your stupidity.

All of the so-called exploits you have mentioned here can be done for a million other apps in the market. Obtain the launcher XML is the most primitive thing possible for tons of other apps and just getting to know their launcher activity is nothing but childish.

This is nothing but a publicity stunt by some wannabe.