So, here, they are replacing the whole database and then stealing the passwords? I would guess that if a malicious actor has that kind of access to the system, all is lost.
As you can see in the next sentence after your quote,
> Exploring only a few of the possibilities this presents we’ll pwn password stealer backends while they parse credentials files and achieve iOS persistency by replacing its Contacts database…
(The major browsers store passwords in SQLite databases, so password stealers upload those to a backend. iOS makes it hard to run code persistently (if you have a shell once, can you keep it after a reboot), so the Contacts database is a target for persistence.)