This is nothing new. I remember an article/paper about the same thing but with pin pads.
Keep in mind, it only works for a very short amount of time as the surface cools down quickly. I don't think it's an attack vector you should worry about.
You can just as easily shoulder-surf the user as he unlocks the phone. It works even better with the "stroke gestures" that is common on android devices - most users don't disable the "draw line" option... it's much easier to spot and remember than a pin pad entry :D
Sometimes you can unlock people's phones by holding them up to the light and seeing where the grease marks are, if they use the dot pattern unlock or a small pin. Got a few people with this in high school.
I was about to mention this in my post but wanted to keep it short :D. The smudge marks are probably as good of an indicator as the heat signature, considering that they don't degrade with time. It also works better with the pattern-type unlock screen on android (but not so well with the pin-type).
That reminds me, you could build a system that records and highlights the smudges (by using a circular arrangement of LEDs and a fixed camera, or by taking pictures from multiple angles under a single light source). It should make a good weekend project, maybe I'll try it :)
Definitely not new. You can easily do this with off the shelf FLIR handheld devices. Used to work in a data centre and our electrician would use the FLIR to inspect electrical panels for faulty breakers. We were chatting about the FLIR and she was like watch this, put your hand on the table then remove it, you could point the FLIR at the table 10-20 seconds later and still see your hand imprint. Was very cool. I think it cost ~$10k or something though.
Keep in mind, it only works for a very short amount of time as the surface cools down quickly. I don't think it's an attack vector you should worry about.
You can just as easily shoulder-surf the user as he unlocks the phone. It works even better with the "stroke gestures" that is common on android devices - most users don't disable the "draw line" option... it's much easier to spot and remember than a pin pad entry :D