People that are raving about security and privacy are missing that this was a Y Combinator event. Invite-only, from a population that's been selected for from the general populace.
Obviously that's why this worked - you're not handing your phone to a stranger, you're handing it to someone who affiliation is clearly identifiable and who is one degree of separation from you.