That does sound pretty poor. However, if the app stores its data in /Documents and you have a lock on your phone (preferably complex passphrase / touch ID) then the app's data should be encrypted on your device.
They should really just store the private key and password in the keychain, it's super simple to do.
Didn't the recent "scandal" about those usb "backdoor" services show that this isn't good enough; you need to set those explicit NSFileProtectionComplete attributes?
The usb "backdoor" applies only to computers you have specifically authorized by unlocking the phone and tapping "trust this computer." If you can unlock the phone, you could just transfer yourself the contents of the bitcoin wallet anyway.
Well, if you have access to an unlockable phone, this would get you access to the Blockchain app's data despite the app's PIN lock.