It is possible for some encrypted wallet to spend coins (e.g. this one) without requesting a decryption password or any other form a authentication. Of course, a password is requested when first importing the wallet file, but nothing after that. This seemingly means that a simple user process has access to my private keys. What prevents another process from replicating the same code and reading the same files so as to spend my coins? There appears to be a major vulnerability, which I am guessing is not real. What cryptographic trick is in play here, to allow such wallet behavior without exposing the user's private keys?
EDIT The answer to the paradox stems from the fact that access to the file system on Android does not work in the same way as on a typical Linux distribution. A file owned by an app cannot be accessed by another app (unless the other app is root). This allows the Android wallet to decrypt the private keys (with password) when restoring a backup file, and save the unencrypted keys to a new file without compromising security. So it is possible for the wallet to spend coins without referring to the backup file again (which would require a password) and simply look for the private keys in the newly created file (which requires no password). (The Answer is due to Nick ODell and Andreas Schildbach, as can be seen from the comments of this thread).