Hey. One of the authors here. Our data set for this experiment is not the set of numbers owned by people willing to download the app, but the set of numbers that they have called and received calls from. This means that a large amount of the data set is things like spam numbers, voicemail numbers, and customer service numbers. Its not too hard to figure out that you bank with Bank X if you are receiving Two Factor Authentication texts from them, for example.
There are potential biases in the data set, but we don't think that they dramatically affect the results that we are seeing. Your mother probably receives spam phone calls and reminder texts from airlines just like I do.