[Android] Testing for Injection Flaws Content Provider #2080

There is an example of a vulnerable Content Provider in this section that has the following manifest.

<provider
    android:name=".OMTG_CODING_003_SQL_Injection_Content_Provider_Implementation"
    android:authorities="sg.vp.owasp_mobile.provider.College">
</provider>

It mentions in the text that the provider is exported so other apps can interact with it. Why is this the case? I think this only holds for API 17 which makes the Content Provider exported by default. Maybe a clarification would be helpful.