Yes, I know. If they implement it properly it's alright.

But my concern is that a it might get a security vulnerability when a nifty hacker finds a way to automatically submit the SMS.

And in my opinion omitting the feature is the best way to avoid that problem.