It's been fixed in the 4.2 beta.
Really, this is only a security threat to your tech savvy gf/bf/friend/thief since it requires physical access. And you know what they say anyway:
Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore
For obvious reasons, Apple prolly hoped this one would slip past everyone undetected until they pushed the next update out.