They're a paid developer, so they are probably signing the app with a stable identity that avoids this.