Well written. I wrote a similar article over a year ago here — https://medium.com/@jakemor/how-someone-can-steal-your-iclou...

It highlights the same exact security issue. The solution is simple: only ask for passwords in the SETTINGS app. Have the alert route users there.