Not enough people seem to know about JTAG outside the hacker and LEO communities but the short version is that JTAG allows anyone with physical access to your phone to chew their way right into it.
I can't understand why fundamentally disposable mass market consumer devices need a working test instrumentation port when they are released to the average consumer; In my opinion this is a significant security vulnerability across the entire Android ecosystem.
--- Added This is not an issue of whether or not the device is secure - it is an issue of whether or not the presence of a functional JTAG interface significantly alters the cost/reward equation for lower value data for a less experienced attacker. Evaluating security risk involves evaluating the costs and risks of compromising a system - there is no system that is completely secure against anything, and a system that is secure against nothing is worth nothing (in this context) (e.g. your phone broadcasts its memory over open wireless all the time) - my concern is that a working JTAG port on a device with 'interesting' data on it is signficantly weaker than one without such a port and therefore the cost/reward equation is significantly changed
--- Added Citation Editor’s note: JTAG is a well-known standard mechanism for in-field test. Although it provides high controllability and observability, it also poses great security challenges.
This article analyzes various attacks and proposes protection schemes. Mohammad Tehranipoor, University of Connecticut - citation -