For years I've been aware of screensaver bugs on some 3rd-party Android ROMs such that the screenlock can reveal the desktop (wallpapers, possibly with some app icons) even if the user doesn't mean to unlock the device. I don't know about solutions other than using another ROM. However, recently I learned that such horrible bug not only happens on mobile devices but also on PCs. It was the compiz window manager on a Linux box. When you lock the screen and press any key, it seems that you can only reshow your desktop by entering the correct password. But this is not true. I simply plugged my Android device to the USB port and guess what? My desktop was shown with currently running programs on the task bar. This might be due to some background services being activated from a hardware event. But for whatever reason this was definitely not what I wanted so I finally said goodbye to compiz.
I'm still wondering why, given the importance of a screensaver/screenlock program, such a bug is still possible. Is the screensaver only running as a normal process intercepting key/mouse events, but with the same privileges as other applications? Is the security of a screensaver solely based on careful programming? What kind of support the OS can provide to make sure the screen is unlocked only when the user really means to do so and has provided proper credentials?