Security researchers cracked a MediaTek-powered Nothing CMF Phone 1 in 45 seconds, exposing a vulnerability that potentially affects millions of Android phones.