Plex Daydream VR is insecure.
If the Plex VR app is linked to an account where the main plexpass user has a pin/password set, the pin/password will be ignored and the user will be automatically let in and given access to that user's libraries.
The TWO Plex UX rules that are missing are:
1. If a linked account has multiple users, Plex VR should prompt the user to choose the desired user.
2. If a selected user is configured with a pin/password, Plex VR should require the user to enter the correct password in order to access a user's libraries.
The Plex web-app and the Plex app for Roku are good examples to follow.