That was my thinking too, surely their school's IRB would have a field day with this. The question is whether they ran this by their IRB at all. If they did it, there would be implications on the ethics of everything coming out of UMN. If they didn't, then the same for their lab. I know at my school things were quite clear - if your work requires any interaction with any human not in your lab, you need IRB approval. This is literally just a social engineering experiment, so of course IRB should have reviewed it.

https://research.umn.edu/units/irb