Has anyone really ever seen a real phone virus?
You'll note it only hit jailbroken iPhones.
You can't expect a non technical person to understand the importance of strong, unique passwords. Most people can't remember more than one (and a simple one, at that).
Is there some part of the story missing here? The only vulnerability I see is that foolish people are allowed to run SSH servers on their phone.