Just curious. There are lots of posts on the web that talk about the fact that unlocking your bootloader wipes apps and data - presumably to prevent unauthorized access to that info. But in order to unlock the bootloader, you need adb access, and with adb access, any unauthorized person could get access to that data even with the bootloader locked. So, essentially, if you've enabled usb debugging, there's no security on this info once you plug the device into a computer. If that's true, the security rationale for wiping this data on unlock is a red herring, and seems mostly to be done to scare people away from unlocking, no?
That said, I guess that raises the issue of whether you should leave usb debugging enabled on a dev mode phone. Also, does unlocking the bootloader open up other major security holes? Obviously allowing arbitrary kernels to boot could be a problem, but without entering your password on the lock screen and turning on adb access (or usb mounting), can somebody get access through the bootloader (or a flashed recovery module)?
On my nexus one, usb access required you to okay it from the phone - i.e. you had to at least enter your lockscreen password in order to say okay. Just got a nexus 4, and usb access is different - you get a choice between MTP or camera mode, but I don't remember being asked whether to grant access at all (don't have it with me to check). But assuming it wouldn't be granted without the lockscreen password having been entered, I guess that's okay.
That leaves the recovery module. I guess anybody can get access to that, and a malicious user (even on a locked phone?) could restore the phone to factory settings and wipe all your data. But could they use a custom recovery module to gain access to the data? All they can do is flash any roms you've put out there, right? - can that mechanism be used to bypass lockscreen security. And in any case, is there a way to password protect recovery?
in order to unlock the bootloader, you need adb acces- This isn't quite correct. In order to unlock the bootloader you needfastboot, which is different thanadb. You can unlock a device that doesn't have debugging enabled. Also, FWIW, some of your concern seems to be with access to mass storage data/MTP over USB being insecure. It is actually considered by the OS to be insecure by nature since it is world-writable, so no personal info (contacts, passwords, etc) is stored there. App data, however, is sandboxed. – eldarerathis♦ Jan 3 at 16:10