I recently discovered an abstract describing this feature as harmful because you can log the users' key strokes - it's called TouchLogger.
W3C has recently published DeviceOrientation Event Specification to
allow web applications to access accelerometer and gyroscope sensors
through Javascript Javascript, which both Android 3.0 and iOS4.2 will
support. This suggests that our motion-based key logger can be
delivered from a website, without requiring the user to install any
application.
Source: http://www.cs.ucdavis.edu/~hchen/paper/hotsec11.pdf
So yes, the phone's Gyroscope must somehow be accessed in JS.