There was a fantastic article last year where Jake Mor exposed this issue, totally nuts it took so long for iOS to fix this!

https://medium.com/@jakemor/how-someone-can-steal-your-iclou...