They don't even have to ask. After years of doing mobile security audits, we complied 42+ best practices for secure mobile development and posted it free online. It's just that secure development takes extra time (and talent) and very few are willing to make that commitment. https://viaforensics.com/resources/reports/best-practices-ios-android-secure-mobile-development/

We examine mobile app security using forensics and post the results free on our appWatchdog page:

http://viaforensics.com/appwatchdog/

In a few weeks, we will have an "appWatchdog app" available for Android which will scan installed apps and advise which store your personal data insecurely. This is good practice in case of a lost phone or remote exploit which can gain access to /data/data.