If true the Xiaomi mobiles own security app had a flaw baked in, straight out of the box.