Tokens on the widget aren’t protected with a PIN or biometrics (set in the 2FAS app). However, they are hidden by default and must be clicked to show up. So, we strongly suggest having a system PIN or biometrics always turned on to protect your phone.
Remember, that removing a widget doesn’t affect the tokens in the 2FAS app, so it’s safe to delete widgets at any time.