Okay, this type of reasoning really is starting to get to me. You aren't the first to mention it in this thread, but it is wrong. Let me ask you this: if you are designing a phone, how else would you test it?

You have to take it out into the real world and test it in real world situations. They gave it to a trusted employee and disguised it as much as they could. And the guy lost it. It's a known risk and it happens.

The choice then became to either activate the GPS and track the phone (potentially making the leak worse) or wipe it. Apple chose to remotely wiped it as soon as they could.

They did what they could to adequately test the new phone and protect it at the same time.