I imagine they will have thought of this — there's probably an authorization step like Face/Touch ID or entering your Apple ID password.