Both. For example Keybase had certificates pinned so hard that I almost couldn't sign my new device because my existing one didn't have a build with the new certificate, and also didn't run an OS recent enough to install the very latest version. I had to crawl Keybase's CDN to find that they luckily still hosted the version I needed. Immediately uploaded to archive.org.
And you'd never predict which mobile software pins certificates. The most randomest Joe Schmoes of apps will have pinned certificates sometimes. It's like the stupid root/jailbreak detections.
