It's just a feature of this particular hack that it was two phones. The real-world manifestation would probably be an NFC skimmer, like ATM skimmers [1]. Slam the virus in, then proxy the original request (or vice versa, depends on the timing), use the network on the phone to connect to the malware hub control, owned phone.

Note you only have to slam a shim in; the shim can then download an arbitrary payload.

[1]: http://krebsonsecurity.com/2012/07/atm-skimmers-get-wafer-th...