It was. They could have signed any phone application to pretend like it was developed by Nokia, and therefore could have done anything to the phones (hence the malware angle).