It's a very buried feature, but the deck actually supports home directory encryption as well, though you have to SSH in from another machine to set it up. I really think it should be made default because of the very real use case where users use desktop mode, sign in to things in the browser and then take the device out in public where it could be stolen.

I have a Deck and never figured out how to make it do that. I also researched all this again when I got the Steam Machine and was setting it up, hoping something had changed, and found nothing but other people complaining about this still being absent (as recently as this year) and info on the rather painful set-up for creating a restricted library for children's accounts (which worked, but, still no PIN lock for accounts).

Maybe it's a PIN to unlock the device period, but not per-account? The former is a lot less useful to me than the latter, and I may have overlooked it. I don't want to have to intervene any time someone else wants to use it, I want to let other people use it without worrying they'll (intentionally or accidentally) end up seeing the wrong library, or messing with anyone else's saves, or anything like that.

If that functionality does exist and I've just not found it, I'd love a clue to send me in the right direction.

This is a setting somewhere in the Deck or your Steam account, my Deck comes right up into my account without ever asking for a PIN or password or anything.