Someone correct me if I'm wrong, but the Android security model doesn't (I believe) extend to files saved on a USB OTG stick. That means that any app could access the wallet-protobuf file.

Although Bitcoin Wallet for Android uses good key stretching for the PIN, it's still short enough to be fairly easy to brute-force by your average PC once stolen by a malicious app. So, not a good idea....