According to this blog post this demo have a security vulnerability:

The Github project Public Key Pinning with Android Volley library shows how you setup an SSLSocketFactory to pin against the SPKI however suffers from security issues such as using the certificates returned by the server without cleaning those first, as outlined above for HttpUrlConnection.

So it seems the this demo is vulnerable to certificate injection in the chain, by a MitM attack, during the handshake phase, thus rendering certificate pinning useless, once is not using a clean chain, but instead the raw chain it received from the handshake.

Another blog post from the author that disclosed this type of vulnerability in the OkHttp library, the CVE-2016-2402, says that we should instead use net.http.X509TrustManagerExtensions.checkServerTrusted():

If implementing this on Android, there are a few new APIs that can help, such as: net.http.X509TrustManagerExtensions.checkServerTrusted(). This returns the clean chain, however it is only available on devices running Android 4.2 or newer.

And this seems to be the same exact approach used by TrustKit for Android.