Not in the background. Apple has a very different system for background app refresh. So only when the app is in the foreground or recently closed it can perform an arbitrary http request

This is technically true in the abstract, but your implied accusation is not consistent with the facts as presented by the article's author in a recent addendum. From the article:

"Some people wrote me saying that the DDOS is not happening on ios devices. Just did a quick check and you guys are right. iOS app is using different way to do VPN and also does not do anything suspicious. I should appologize to you and to Appstore team for my lazy extrapolation without actually checking it."