This is true, I did not continue past the continue button so you are most likely right it would need a password afterwards to authorise the transaction - but it's still an easy mistake to make and something that shouldn't be allowed to happen - it's obviously been done that way deliberately to scam Steem Power delegations off people.