There's a nice irony about the exact security flaw being reported, then being used against the journalist who reported it. I would have expected the journalist to expect that though, and get a phone from another provider before investigating? Maybe she was actually hoping this would happen, just to prove the point and multiply the story.
On Vodaphone's part, this whole episode seems spectacularly stupid, like a drunk man who just caused an accident shouting "I'M PERFECTLY CALM!!1!" Um, you just proved the point.