> it uses the exact same authorization mechanism as a real iOS device and grants the user access to no more than a real device would.

And a hacker that social engineers someone's bank password is entering just like the account owner would. "Hacking" doesn't have to involve exploiting a technical vulnerability. It's just unauthorized system access, regardless of methodology