That app (and all MITM proxy apps such as SandroProxy and mitmproxy) work by installing their own trusted CA certificate on the device. That allows them to sign their own certificates which the device will accept.
You have to manually install their certificate to the user key-store using a dialogue such as this:

After which it displays warnings such as this:


It's unlikely (albeit not completely impossible) that a user would do this unintentionally, so overall it's a reasonably low threat.
Having said that, if you want to protect your App even if someone has installed a malicious CA certificate then you should implement certificate pinning.
If the device is rooted then it is conceivable that an attacker could install a malicious certificate, conceal it, and modify your Apps to compromise validation and prevent pinning. However, if something rogue has root access then essentially your entire device is compromised any way.