I fear we're both working from second (or third)-hand information here and it's time to do some homework to find out the truth, but let me add this one thought.

This may sound like a stretch, and Apple themselves have decided that it's not sufficient, but while the files themselves my not be encrypted the filesystem of the iPhone itself is protected from all but deliberate (and possibly illegal) fiddling by third-parties. In this way it's not completely dishonest for the iPhone's exchange client to report to the Exchange server that the local files are secured.

Like I said it's a stretch, but perhaps the original implementation wasn't pure malice/ignorance on Apple's part.