I believe there's a bug in the local readBooleanFromProps helper in the Titanium CLI hook resulting in the two appc-security-* properties to always be evaluated as true when the type is set to bool.
Build a project with trace appc run -p android -T device -b -l trace to verify that:
It also looks like the fallback if type is not set should evaluate !!prop.value rather then !!prop.