Actually, I'm pleasantly surprised by this article - you're quite right that IMAP ticks all the boxes you could describe as essential for mobile email, and you're equally correct that the iPhone's implementation is rapidly being uncovered as rather poor.
A couple of things, though.
As kael mentions, IMAP most certainly does support flagging of messages for triage and other reasons. It's pretty well optimized for low bandwidth, too - bear in mind it was developed mostly over 2400 baud modems on very low-power machines.
Of course, Lemonade (RFC 4550, the successor to abandoned P-IMAP) improves this even further, and there are more improvements coming, both in terms of featuresets and optimizations.
And of course, it's not intended as a monolithic protocol - Mark Crispin has rightly fought attempts to make it so (even mailbox management he'd have preferred to remove). So it's certainly true that IMAP does not (and should not) perform all the kinds of access you're describing, here.
For example, my own - Lemonade compliant - client manages to roam its configuration across desktops, laptops, and handheld devices. It doesn't do this through IMAP, but ACAP - the protocol specifically designed to do this. (So I also get access to my personal addressbooks on the move).
One thing you definitely need to be called to task over is that the security behaviour on the device is *way* outside the scope of what IMAP supports. An IMAP client could quite easily be written to enforce a security policy it fetches over the wire, and an EAS client could also be written which ignores it.
Overall, a surprisingly neutral article, though I'll cheerfully challenge you to beat my bandwidth figures. :-)