As a Microsoft fanboy it's hard for me to acknowledge this, but I think there is a bit of a problem here on Exchange side's as well. If I unerstand correctly, it asks the device if it supports on-device encryption of data and then trusts that the device claims the truth. I think the problem with this approach is that the security of the network is no longer in the hands of the network's administrators, even though they might have the reason to believe so since they have set up Exchange to enforce on-device encryption even though it can't possibly enforce that in all cases and as the iPhone example shown it, this is not just a theoretical problem.