It doesn't show in my wallet yet, but this is bad 
If they don't mind their users getting scammed, as long as they earn from it, what's to stop them from selling the wallet to a scammer (just like a certain paper wallet site did)?
I can understand that it can sometimes be a challenge to determine if a service is a scam or not
I've also seen wallets that promote an exchanger service that has several scam accusations against them.Since mycelium is open-source and noncustodial, at least I know my fund is secure.
If they decide to scam their users, just one (automated) update is enough to give them access to your funds. The 6-digit PIN isn't going to save you from that.If they don't mind their users getting scammed, as long as they earn from it, what's to stop them from selling the wallet to a scammer (just like a certain paper wallet site did)?