You're mostly talking about what's basically a phishing attack, right?

I'm not really sure there is really any defense yet devised for phishing attacks against 'average non-power users.'

I'm not disputing you though, I think it is a problem. But unrelated to how securely a given app stores sensitive info, which is what OP is about.