I looked through the security guidelines and it's pretty clear that there's going to be a few implementations that aren't sufficiently secure. It appears that most or all of the work required to secure your content is up to the developer.

Does anyone know how this compares to the iOS implementation of in-app purchases? I would suspect (without any evidence) that Apples provides security mechanisms for this as part of the API.