They do pin certs. I don't disable pinning, I quite like the protection it gives me. I actually inject code at runtime to observe and modify behaviour.