[laken]

My (possibly un-educated) guess is that these particular infected devices are insecure out of the factory, with these ports open and debugging enabled.

It's not unheard of for certain shoddy Chinese electronics to have glaring security holes out-of-the-box, and a lot of these types of botnets go after insecure IoT devices. A decent section of the IoT market uses Android, and it wouldn't surprise me if these ports are left open with the debugging installed.