If I wanted actual security I would be using a full blown password and full drive encryption (both supported by Android).
But then I'd have to turn off all my toys like sync, USB debugging, and unsigned package installation. Which I don't want to do. So therefore I just take my phone being relative insecure as a given, and try to keep out the casual pranksters and or nosey people.