Any speculation why they would only leave in the malicious code for about a month? Changed their mind? Done without full knowledge? Achieved some high value heist and rolled it back?
An update to an ad library is what caused the malicious code in the first place. Presumably either the infected library was updated again or the developers switched libraries.
The developers behind this app did not add any malicious code they wrote themselves. The attack either came from the ad library or the ad library was hacked.
If it's the case that it was accidental I feel bad that the app was pulled rather than only vulnerable versions forced off. Although I suppose it would be hard to find assurances that it won't happen again.