Thank you for raising this up and giving us a chance to explain. The reason you brought up is exactly why we introduced SMS Command PIN in WaveSecure.
When you send SMS commands from another phone, the message will be in plain text. To prevent the original PIN from being compromised, WaveSecure now lets you specify a SMS Command PIN to prevent the thief from getting your original PIN.
The SMS command PIN only works for lock, locate and wipe. Therefore, even when the thief got to know your SMS PIN, he will not be able to unlock the phone.
Also, the WaveSecure lock screen only accepts the original PIN, not the SMS Command PIN. This way, even if the thief gains access to your SMS Command PIN, there is no way for him to unlock the phone.
Alternately, you can just use our secure site and not worry about SMS Command PIN.
Hope that clear things up.