The high priority is making it safe to use, even if your computer gets infected by malware.
I don't see how can that be possible without the use of a "uninfectable" dedicated device to sign the transactions.
I wouldn't even say strong security to non-tech users should be a priority of the reference implementation at all. Leave that to clients like Armory. The reference implementation should focus on the protocol, IMHO.