Your iPad passcode protects and encrypts the contents of the iPad, including the data decryption and data encryption keys.
Effectively, the passcode is how the data is encrypted and decrypted.
The passcode protects this iPad data, and not the Apple Account password.
The iPad contents can (usually does) include saved passwords, as well as other sensitive data. But that's not a factor here.
In this case, the contents of the iPad were relocated, and the passcode for the device was (as expected) used.
More generally concerned about iPad and Apple Account security? Use Face ID and Touch ID and a longer and more robust passcode (password). The use of biometrics makes operating with a more robust passcode (password) more tenable, as you need enter it less often. And biometrics makes it more difficult to “shoulder surf” passcodes. My current passcode is rather longer than 12 characters, and a mix of characters, for instance; a password.
Related info: