I think that Cyanogenmod patched this.
Encrypting secret is useless, as attacker can replace Mycelium with fake and just wait for user to enter PIN.