What expense of security?

Projects that are based on beaker and are currently live, probably use pickle. If you decide to switch from pickle to json (and vice-versa), that try block will make sure you don't lose that data. When it reads the data, it tries both formats. When it writes back, it uses the selected format. That means existing pickled data will be json serialized. So, basically, it's for compatibility.

If you think that data might be compromised, then you should probably delete it yourself. My concern, as a developer, is not about your data, but the behavior of the library.