May be because it is a bug not vulnerability? Also, if someone with malice intent can get physical access to your phone then may be you will have much more to worry about?