If I had to take a guess they're using something like Phonegap/Cordova (i.e., this is a hybrid mobile app -- basically just a browser view with HTML content and JavaScript that can make use of the device's hardware and accounts). A common mistake I've seen is people using the stock Android manifest that comes with Phonegap/Cordova. This manifest enables ALL permissions so all the native functionality plugins "just work" out of the box. However, you're supposed to pare down the manifest to remove permissions for things you don't actually use so you don't end up in this situation.
This is PayPal, remember? The likelihood they're using PhoneGap is so low that I'm going to state it isn't, without Googling it. (gasp) Did you read the first article?
And indeed it isn't (got the latest com.paypal.android.p2pmobile from play store and checked). They do to have an HTML component to their app, a Tour guide found in assets/ ("Pay with PayPal in Stores!").
I'm the same person as above, btw. I have noprocrast on that account. It is working very well for me ;)
They have, however, authored a Cordova plugin for others to use the PayPal SDK easily from their PhoneGap apps [1]
