There is normal unix security to protect the data.

Sailfish protected data are in privileged group, and normal android applications don't have access to that group, as android apps run as randomuid:nemo-group. So they only have readonly access to nemo users dirs (if group has +r). If you make sailfish application, and chmod g-r on the file, then android application cannot read it.

But yes between sailfish applications both are running as nemo, there is no read access restrictions, but ofcourse you can encrypt your sailfish applications data files. And even normal nemo user sailfish applications cannot access the data from Jolla applications privileged group dirs (like facebook contacts etc are protected).