I believe hackers do not use constant addresses and tend to change them frequently.
In this specific case, the address list was hardcoded in the libraries: the program then selected the address best matching the original one to deceive the user in using a visually similar, but diffrent address.
I understand that, but my remark was more general, i.e. relying on third party like Blockaid is the weak point for the Tangem as well as it is for any hardware wallet without its own display. Even if Blockaid’s techniques helped in this specific case, that doesn’t guarantee it will protect users in all situations. That’s why I never use WalletConnect when working with my Tangem.