and most of all, do not forget the logfiles on an open server (it was their mistake, otherwise it would have been fine I think)

Or just hack the phone of those few clients with another attack vector. Doesn't mean that security is entirely useless. It depends on the threat model.