Third-party Android apps that use Dropbox's software development kit could have allowed an attacker to reroute any saved data to a different Dropbox account.