Is there any reason to suspect that Mr. Crooks had both a non-trivial password, and a model of phone with no physical_access => root weaknesses? My impression

Is there any reason to suspect that Mr. Crooks had both a non-trivial password, and a model of phone with no physical_access => root weaknesses? My impression so far is that he was a very young, low-skill, and probably impulsive - all of which correlate with swiss cheese infosec.