Indeed. I'm thinking this is less and less secure with every word I hear about it. Here I was imagining it used overlay effects from a system process and some kind of Kerberos certificates or other mechanism to convince the computer to login for real. A fake password screen... sigh. Sounds like the next virus.
I completely agree, I'm actually really annoyed because I paid $4 for something that I wouldn't have paid $0.99 for if I knew this is what they were doing. Now $4 isn't going to break the bank but still I thinks it's misleading not to point that out.