@Andreas - you are missing the point. Security folks want to see a device supports ALL of the flags in a security policy, not just some. The storage card encryption is just an example of one setting in this list of deficiencies for various devices:
http://en.wikipedia.org/wiki/Comparison_of_Exchange_ActiveSync_Clients
It really doesn't matter if you or I think the iPhone (or any phone) "is a really nice device when it comes to Exchange compliancy", there are the security people some of us have to answer to that wouldn't agree with you. Right or wrong, it's a reality some of us have to deal with.
Also it's irrelevant to me if the device today has an additional storage card or not, as there is always the next generation that could. Building support for the policy now, especially if it won't hurt anything, should be the direction everyone is heading in so that future models are already in line.
And I don't know if this would be considered a "storage card", but there is at least one unique external extension to the iPhone's storage capacity:
http://www.airstash.com/
In an effort to not bicker with you over details of a single specific detail like which model has an internal storage card, my intent has been focused on the original point that Mike Crowley raised which is that some of us are going to have to deal with security folks who want to know that they can flip every bit and not have devices ignore them. Also those same security folks really like the "block non-provisional devices" setting which has caused issues for some us trying to support devices with partial implementations of ActiveSync. A second tier logo that ensured those settings are accounted for would give all us a serious piece of mind and a bar for everyone to raise to.