I'm having a hard time believing this.
If I found a security exploit in an Apple product, I wouldn't go telling about it on a Lego forum. I'd go search up Apple's customer support and contact them immediately.
Assuming this is legitimate, if you haven't contacted them yet, now is the time to do it. If other people discovered this it could potentially be disasterous.