Great reporting from Christina Warren over at Mashable. You should read the whole article (title link), but here's the premise:

For just $200, and a little bit of luck, I was able to successfully crack my own iCloud password and use EPPB to download my entire iCloud backup from my iPhone. For $400, I could have successfully pulled in my iCloud data without a password and with less than 60 seconds of access to a Mac or Windows computer where I was logged into iCloud.

Apple needs to fix this.