If someone leaves their phone unattended I can gives a thumbs up and get them on the hook for tens of thousands of dollars.
Yes, its a vulnerability, its also a serious legal wrong in its own right (on top of the trespass to chattels you need to do to accomplish it.)