Good catch! I'll check the originals out and see if a patch needs to be made for the vanilla and Totsc games.
There is a flag which can be set on the creature file which will keep the marked item from being pickpocketed. The only downside is that even though the flag is set on the creature file, the inability to be pickpocketed continues to be persistent even if it changes hands whether that be through dialog gift or looting after death. For some items such as bandit scalps, gems, rings, etc... that persistence becomes an issue in multiplayer games where the players like to steal from each other.
In DLTCEP the flag is labeled as unstealable (again on the creature file not the item file).
For a quick and dirty weidu patch, download my copy of the bgfixpack located at my website (link should be in signature but in case it is not
http://sasha-altherin.webs.com/index.htm). Find the bandit scalp exploit fix component within the tp2 file. Pick the traditional baldurdash and dudleyville style fix subcomponent. Copy it to a new tp2 file with your own AUTHOR and BACKUP entries. Remove the require component string and the subcomponent string. Change the patch title to something of your choice. Change the regexp entry for the copy string to the exact cre file name of Brage. Change the item file name being matched in the STRING_EQUALS_CASE entry(ies) from misc86 to whatever the item file name is for brage's body. After all that, give it a test run and see if it works.