Interesting case study and cautionary tale about the rush to app development using codebases that are plentiful but untrusted. For the sake of taking a little extra time in development, you can either establish that trust with some form of code-signing or just build it yourself.
It strikes me one mitigation would be to shut down outbound SMTP connections to the server or over the port in question (2525?). I am not sure I would call it a "sophisticated" means of retrieving the keys. SMTP has been around for almost 45 years, but again, one of the issues with using these all-encompassing frameworks/codebases (like NPM). You end up with an app that has far more capability than you need, and if an attacker can get in there, they can leverage those capabilities to do what they want. Again, these vulnerabilities are all because we don't want to spend a little more time on the development side.
