Yes, an app is required to trigger the surveillance since beacons are one-way, but not really a 'malicious' app install. If tomorrow candy crush/angry birds want to tap into the gimbal database, well congratulations. Worst, if FB/Google want to tap into the database, nearly every android/iOS phone with BLE on will be a target due to their massive app install base.