I don't know your setup, I am on CSSU T8.2, as this is Thumb Thread I guess you are referring to thumb. Shouldn't be different though. For me it works as you (and I) would expect:

If I select "Secure device" from power menu, it is locked and - as you asked - by tapping "outside" asks me if I want to turn it of, thus hence it being a feature.

It should not ask for a PIN when selecting "secure device". Maybe you haven't set one permanently in the settings, resulting in asking every time for one? This would be a feature I am not sure I would like.