ASCII was interpreted as UTF because the function that checked whether the given text was Unicode checked the difference between bytes at even and odd positions. Many of the common phrases used to trigger this were in the 4-3-3-5 format (by letters), e.g., Bush hid the facts However, there was never any reason that this format of character placement was necessary for the bug (though even length was necessary)
The DKTB is a personal app. It is therefore assumed, that the User will not share it with other people, and that only the User can access and control their personal DKTB. Ultimately, this means that all attestations in a DKTB are expected to pertain to and only be presented by the same User. This is enforced by requiring the user to authenticate using biometry or PIN-code when using the app and only allowing the DKTB application to be installed on one device per user. (from the PDF)
This is a false assumption: PIN codes can be bypassed by sharing them with others. Devices can be faked unless using hardware attestation, which prohibits any modifications to the device which may be undertaken by those interested in rooting or installing a custom OS.
Users can initially acquire a DKTB on their smartphone or tablet via Google Play or the Apple App store. (from the PDF)
This method requires the use of a vanilla, unmodified device, effectively prohibiting modifications to devices that one might wish to alter.
That data might be easily accessible, but that was a choice Root made. I think that it is a safe assumption that Root knew most vigilantes keep their identity secret and, assuming a German background, had read Section 202 of the StGB and other relevant laws and court rulings. As such, Root most likely did this despite knowing their identity is at risk. It is likely they did this publicly specifically to inspire others, though I haven’t looked at all the details and there might be a different reason.
Nothing in this comment constitutes legal advice.