Not to mention some portion of photos would have to be out-of-date or otherwise unusable.

My guess is the app probably just approved anyone or nearly anyone. It's unlikely someone without a boarding pass would try to get on and it's likely that anyone with a boarding pass who got disapproved would be pissed.

Or who knows, maybe homeland security did a mechanical Turk and had someone at the other end looking at faces and checking off names.