I wouldn't suggest you try this yourself unless you are very cautious, but I noticed that one can drop an expensive item on the ground without being prompted for your PIN! So, if you log out with anything valuable worn on you or in your inventory, if some rascal were hypothetically to get into your account they can simply drop your items in a relatively empty place, accept the confirm prompt, and completely circumvent the bank PIN. Isn't this something that should be fixed? It's one thing if you lose a token drop or if you want to drop items during powertraining, but wouldn't it be possible for Jagex to put a PIN-lock on dropping valuable items? They already have it in many places like Artisan's Workshop and even clan settings, and I certainly think it would be a worthwhile cause to add it here.
Is there some reason I am not getting that this hasn't been done? Surely I can't be the first one to discover this...
So to summarize my suggestion:
dropping iron ores while powermining - no PIN required
attempting to drop your bandos armour set - would prompt you for your PIN.
For the meantime I suppose it would be best to bank all your items and armour before logout just in case, especially if you don't have Authenticator on your account.