The applicationStorage directory doesn't require any special permissions from the user to access -- it's great to store configuration and non-user access data (like thumbnails or other 'temporary' type data) since the data gets automatically cleared if the app is deleted. I use it for all my application data as the user cannot access the directory data location to review the data. You'll notice that from your PC you can access the 'general' shared directories of the BBOS device (like 'documents' or 'downloads') but not the application storage locations or user identity locations.
The userDirectory refers to the same data as you can acces through the explorer in windows so there's no risk in using that directory in your applications in my mind - those are managed user data locations. This is my opinion. Access to this directory needs to be accepted by the user (through the property <permission>access_shared</permission> in the bar-descriptor.xml file).
The userDirectory doesn't refer to any secure data locations (no contact info or system properies etc) just shared user data.
