Perhaps because the attacks/exploits were more against the device/OS and not against the app itself?

It is unsurprising that text can be found unencrypted in memory---even while during rendering it has to be decrypted somewhere.

The only mildly surprising/troubling thing was unencrypted data stored in the file one disk on the phone.