See update at bottom: The leak only applies to phones that were shut down while unlocked. It appears the phone doesn't lock until after the host pairing code st

See update at bottom: The leak only applies to phones that were shut down while unlocked. It appears the phone doesn't lock until after the host pairing code starts so there is a window. This will not let an attacker into a lost, locked phone. But if you shutdown your phone, it would be a good idea to lock it first.