True, yes. But this is for a financial services mobile app... one of the first concerns was the user experience. The org is well versed in the other back-end security and data issues that also have to be looked at.
But if you're Facebook, and you're pushing your SDK as a great solution and it's embedded in high profile apps and you are letting this happen a couple of times, I get to make fun of you. (a dollop of sarcasm, to be sure..)