The use of certificate (or public key) pinning can be considered as a good practice for defense in depth, since it protects an application from man in the middle and DNS hijacking attacks. But can it be considered a flaw in the application itself?
Let’s take from example a case where a self signed certificate is either installed in the mobile phone or is signed by a trusted CA (using Let’s Encrypt), and an application that uses the phone trust store to determine whether a certificate is trusted. In any of these cases, an application without pinning would be exposed to MITM attacks; however, in order to do so, either a malicious application (or even the user, by social engineering) must install these certificates. In both cases, if said applications can accomplish this, they can go much further and take over the phone entirely.