Why does GMail appear on my phone without unlocking?
I am also using the App Settings extension, and 'Show when locked' was enabled. D'oh. I don't think I did this, but might have done whilst experimenting with my new phone!

Thanks @Chahk1 for the helpful comment which gave me a hint on where to look. :)