Because the device was rooted. At which point nothing stops the malicious app from downloading compromised copies of core applications (or to download and install a new service, or get a server running) and install them in the System partition.
If you factory reset, you will wipe the Data partition but the System partition remains intact (as there is no way for the device to restore it since it does not have a copy). Alternatively, you can re-flash a stock (or custom) ROM.
Slashdot Mirror
Because the device was rooted. At which point nothing stops the malicious app from downloading compromised copies of core applications (or to download and install a new service, or get a server running) and install them in the System partition. If you factory reset, you will wipe the Data partition but the System partition remains intact (as there is no way for the device to restore it since it does not have a copy). Alternatively, you can re-flash a stock (or custom) ROM.