The bug was in the Android OS but my point is that app only wallets are not immune to having a bad RNG.
But Android's /dev/urandom taps the kernel CSPRNG, not a weak userspace library. Your self-custody risk is usually key management, not entropy generation.