Steam exploit regarding Russian pay kiosks

[Minox]

The username you log into Steam with should be private, your profile/display name is public. The kiosks should be updated to require password validation though.

They shouldn't need to do that tbh, they could potentially just add a confirmation code that you have to enter before the money gets added to your Steam account.