Nothing, he was just selected (based on who knows what criteria, they don't need warrants) to be scanned. Whether or not they actually cared about the sensitive data on the device, he still lost control of it long enough for it to be copied or compromised.