Kelly did the right thing here, as long as he truly hadn't been carrying/using the phone then the compromise is pretty limited.
If he had been using or carrying the phone and it was a failure on the recent update that alerted him then it represents two problems: an operational security one and a scandal.
I hope that his integrity holds up on this one.