The vulnerability requires physical access, but underscores risks for users who store private keys on their smartphones.