Nigel,
Everything what you said match up well with what folks at EverythingAccess.com says; they also sell MDE Code Protector that delete this dump file (which they call compiler junk).
Furthermore, to be explicit-
MDE may do away with source codes, but it doesn't hide strings & variable names; they still can be read in a text editor. To protect those, you need to encrypt it also, but the Access's encryption is totally useless; analogous to putting the door key under the front door's mat. You just need to know where to look for the key to de-encrypt and you're back to the exposed variables/string names.
Decompiling MDE, OTOH, would be quite a challenge (but not impossible as you obviously have done it, and so has the folks @ EverythingAccess.COM, but would require proficiency well beyond an average office monkey, and if the data is *that* sensitive, it wouldn't even be in Access to begin with.
So the moral of the story, I suppose, is that MDE is *great* for protecting the IP of your database, but not so much for data itself and you will have to take steps to secure those if necessary.