If you know the installed file name of the apk (which on some devices may be myapp-1.apk or myapp-2.apk rather than just myapp.apk) you can directly access that as an ordinary user including the one adb runs as on a secured device, so you should be able to adb pull it. But if you don't know the installed apk name, you cannot browse the /data/app directory without being root or aid_system.
It might be worth just guessing at the installed name - try it plain, try it with the -1.apk, and the -2.apk, etc.
There may be another way: I believe the following will work on a secured device but don't have one in front of me at the moment to test it.
EDIT: New idea for determining exact APK file name
1) adb pull /data/system/packages.xml
2) Look through it for your application's codePath entry
3) adb pull that
EDIT: With regard to the old idea below, Matthew discovered that while the per-process files under /proc have read permission on a secured device, they are empty when read by an unprivileged uid other than that of their owner. So this won't work.
1) Get your app running. You'll also need a machine with adb.
adb shell ps
and look for the line with your app's name:
app_1 11959 907 112984 27580 ffffffff afd0c5bc S com.clevername.myapp
3) take the number in the second column which is the process id, and view it's virtual memory map, in this case I would type
adb shell cat /proc/11959/maps
and look for a line where it has mapped its own apk file into memory
43e9c000-43ea3000 r--s 001f4000 b3:06 15393 /data/app/com.clevername.myapp-1.apk
4) That's the file name you would need to adb pull
adb pull /data/app/com.clevername.myapp-1.apk .
Examination of the directory permissions in /proc suggests this should work for an unprivileged user, my apologies if it does not. If you are familiar with the usage of 'grep' you can use that to avoid manually scanning the output.
Addendum: I'm not really sure what the story on apps installed to the SD card is.