A smart lock that has won an award can be broken into by anyone with a smartphone, say researchers.