True code-injection (of executable machine code) is normally pretty well defended against by non-executable stacks, and W^X (write xor exec) page permissions in general.
If we're talking about a buffer overflow, more typical modern payloads are some return addresses for a ROP attack. This isn't code in the traditional sense, just the address of code fragments already present in memory. (Perhaps as the last 2 bytes of a 4 byte instruction, if we're talking about ARM Thumb2 mode, since this was a phone.)
e.g. if you can find code that gets the right data into registers and then returns, you can put the address for that, and then the address of
system() in libc, on the stack. So execution reaches
system() with a pointer to a string in the right place for it to treat it as the first arg.
That string could be something that happened to be in memory, or it could be the non-code part of the payload.
By the time the information has been diluted this far by tech journalism, it's hard to guess what exactly it's talking about or rule out any possibilities.