Cqman had installed a 1.8.3 firmware version and in that version the password/pin settings was activated, how you can see the screenshot
on this page . I don't know how he got that version of the firmware (with Pin settings activated), but on 1.9 firmware the password/Pin settings is one more time deactivated.
On Android 4 was easy to unpack the firmware (
here a tutorial), edit the boot.img file and flash it one more time. On Android 6 it's more complicated, because now Onyx use a upk format and it's more difficult to handle itt. Booxtor said a couple of weeks ago an extended version (with password settings activated) of the last firmware will be available soon. Onyx Note is a great device, but without a minimal privacy protection It's difficult to use it with confidential Information