The website is super polished and doesn't mention anything about being alpha quality. It would be easy to install this on your phone without any idea you were making yourself vulnerable.
and sure, you can blame it on the people using the software, but that doesn't stop a bunch of ssh servers with default credentials being open to the network.
My definition of super polished includes 'renders without javascript enabled'.