Honestly, I’m not entirely sure why, but for whatever reason these boxes are always running a pretty old version of regular Android. (Edit: in fact googling a couple of the devices in the article seems to confirm that)

Maybe there are more protections preventing this kind of malware on newer versions? Maybe someone just made the images a long time ago and people are just reusing them