I was under the impression that this was by design. I guess it depends what expectations you have for a passcode lock.
My expectation is that my phone is reasonably secure from co-workers when I leave it on my desk for fifteen minutes at a time. And that if stolen, I have enough time to remote-wipe it before the passcode is bypassed.