Yes, you do need to enter your PIN to make purchases. If you lose your MagicBand you can stop by guest services and they can disassociate the band with your account (you might even be able to do this through the app, I know you can through the full web version).
Thank you. That sounds like reasonable safety measures then. Coupled with tying it to credit card protection allows me to feel better about that.
I can tell you from experience that this works just as @jakeman said. Unfortunately, I lost my MB in December. The folks at the service center at DHS deactivated it for me, just in case, and would have provided me with something to allow me to use remaining FP+ for the day had I needed it (didn't, because it was almost closing time). When I got back to my resort, it took all of 3 minutes to get a replacement magic band and link it to my account.