Abandoned Popcorn Time apps were disabled to keep them from being turned into a botnet, a network of hijacked devices that can be directed to do an attacker's bidding.
Researchers at Eye Security found the updater for a Popcorn Time fork called Time4Popcorn running on Windows, macOS and Android devices around the world. The updater phoned home to web domains that had since been abandoned. It did so over unencrypted HTTP, and it ran an outdated, insecure version of Chrome. Coverage of the findings described the software as installed on millions of devices. Development of the app, which wrapped torrent streaming of movies and TV in a friendly interface, has been dead for years.
The account does not say who disabled the apps or how, so there is no basis here for saying how many devices are still exposed.
The combination is what makes the finding matter. An updater is a trusted channel: it tells software what code to fetch and run. When that channel points at domains nobody maintains and travels without encryption, control of it is no longer tied to the developers. Anyone who controls the domain, or sits in the network path, is in a position to answer the app's check-in. An old Chrome build adds known vulnerabilities to the mix.
None of this requires the app to be popular today. Piracy tools tend to outlive their maintainers because users install them and forget them, and that makes them an unusually poor fit for an update mechanism that still trusts the open internet.
The lesson is less about piracy than housekeeping: software that checks in with a server nobody owns anymore is a standing offer to whoever picks up the domain.