A bad actor can do a lot of things if they somehow gain access to your unlocked device. You seem pretty concerned with security, so as your first line of defense, I would suggest you don’t “borrow” your phone to someone who would steal your passwords and don’t walk away from your unlocked device in public spaces.
I actually don’t think that requiring a password before adding a new device to a Sync chain wherein passwords are being shared is a bad idea, it looks like this has already been mentioned even:
But saying that we “treat security is a joke” is needlessly inflammatory and obviously not true. I will try and get more eyes on this issue from our devs.