Unfortunately I have seen that gizmodo article , and gizmodo is trash and no one should read it. They're a COMPLETE JOKE. I don't know much about engadget however so I will hold off from commenting on them, I used to just go there occasionally in the past. All I know is, McAfee never revealed the method he used, and so anything these media outlets spew is speculation.
Regardless, it does not change the bottom line --
On a PC, for a keylogger, a virus, any malware, ransom-ware, spyware, adware, there are anti-virus and anti-whatever tools that try to keep up with them daily, that scan for them being on your PC and quarantine and remove them. OR simply detect and stop them before they are installed on your computer in the background without your knowledge.
On Android, is there such a danger? McAfee is out there saying, yes there is.
Say McAfee gave me two phones with malware installed on them, and one of these phones has his anti-spyware tool and the other one does not OR has some tool that you can currently find in the appstore (useless anti viruses that do nothing). --- One phone will detect a vulnerability and plug it, the other phone will be vulnerable and I would not be aware if it. Just compare this to the PC world (i.e. a laptop with the latest anti virus definitions, vs a laptop with no firewall, no security what so ever, after using both in an identical manner for a period of time, you will find one is infected with a whole bunch of shit and the other very minimal or zero).