It makes a lot more sense to have a different string object for secure strings, that isn't shared. I'd like to see that. But only a small part of Pike and cmods would be able to use it, if someone doesn't come up with something clever.
(But if there were a way of making a more generic string object that Pike and modules understand - then it would have nice effects for transparent uses of data-on-disk, data-on-network or mmaped data.)