It would have mattered because you can deauthorize a device from your Google account on a computer, like a phone and if they are saved locally as well you can remove SD card before sending it back. The only thing I'm unsure of is if thumbnails are saved in a standard image format but those should get removed as well during the notification that the device has stopped syncing, but if mobile data is turned off it may cache a few low res thumbnails.
I'm not saying it has one, again the point was for people RMA'ing devices in the future to help prevent issues like this. A startup password with encryption could have helped prevent this.
