To my knowledge this is true for normal android as well (perhaps not that authentication is required); the data is encrypted against the passcode.