Now that you mention it, I do recall an issue where RRT shows "optional" when building on 4.5 for a certain package (don't remember which), so the sig tool doesn't sign it. However, when you run on the device, it throws the security exception.
Take a look at this:
Re: Move signing keys to a new computer... - BlackBerry Support Community Forums
I recall that we hit this issue on one project, and wound up adding a reference to some additional secured API that we didn't need, just to force the RRT signature.