The lack of hostname checking for IP addresses in Apple's cURL is a completely different problem.
No but it says something about the quality I can expect from the black boxes that Apple provide me with. And its not a good thing.
Lock screen has been vulnerable with a bypass exploit on several occasions so caution is probably a good idea. Way too many times to give me any sort of confidence.