A few different ways. It could be a supply chain attack as in the applications code base gets taken over by somebody. And what looks like a regular update, puts malicious code on their device.

Or a lot of apps dynamically load code from remote servers so somebody could take over one of those remote servers and inject something malicious into it.

There could be a compromise in their software development kits or SDKs. Meaning that a library that somebody is using could unknowingly get compromised. Therefore putting malicious code in an app without realizing it.

I'm sure there are other ways that I'm missing too.