I found out that, because of the non-static IP address of mobile phones, their open ports are supposed to be more susceptible to attacks.
I think you misunderstood the paper, most likely this segment:
In the recent evolution to the mobile era, smartphone operating systems inherit the support for open port. But for smartphone applications (apps), traditional open port use cases such as hosting network services no longer apply. One major reason is that compared to stationary server machines with wired network connectivity, the mobility nature of smartphones makes it difficult to maintain a stable IP address. Moreover, the IPs assigned to mobile devices are often behind a NAT (network address translation) pre-venting incoming network connections. Also, continuously receiving network traffic can easily drain the battery of a mobile device, leading to a form of denial-of-service (DoS)attack [49]. Due to these inherent differences, our current understanding about smartphone usage of open ports are rather limited.
What this section is saying is that our assumptions about open ports only generally appearing on servers, as they have a fixed IP address (or at least domain name) that we can talk to rather than a dynamically assigned address, mean that people haven't really considered looking into open ports on mobile devices from a security perspective. The fact that the IP is dynamic doesn't factor into the security considerations all that much, but the assumption that mobile apps wouldn't bother opening ports because there's no real way to know what external IP address that mobile device will be using (and that it may be behind NAT) is wrong, and that incorrect assumption means that many users and vendors don't consider open ports as part of their security model. As it turns out, many apps do indeed open ports, and the paper describes a few ways that certain apps can be abused because of it.
An open port on a mobile device is no more or less secure than an open port on a traditional computing device such as a laptop or server. The difference is that mobile operating systems don't typically run a firewall, and running one by default would probably make for a poor user experience in general since most users wouldn't know how to configure it properly. The end of the paper instead focuses on ways that apps can mitigate problems with open ports, since a general-case firewall is not ideal.
