I guess it's because virus writers also to try to root the devices to install rootkits. I'm quite in favor of requiring hardware mods (although I'd prefer a jumper...) to modify the OS.
You'll note it only hit jailbroken iPhones.
You can't expect a non technical person to understand the importance of strong, unique passwords. Most people can't remember more than one (and a simple one, at that).
Is there some part of the story missing here? The only vulnerability I see is that foolish people are allowed to run SSH servers on their phone.