It's not clear why I have to provide evidence that my phone has any vulnerabilities to justify being my being uncomfortable handing it to a stranger with a known criminal past. Security comes in layers and one of those layers is physical security.
I was thinking the exact same thing. I am giving my phone, that has photos of my home, family, loved ones, addressees, etc. etc. to someone who has a criminal past. It is like giving your kid's photo to a pedophile. I prefer if offenders handle my food instead of shitloads of private and sensitive data.