I just checked -- *creating* widgets is PIN code protected too.
However -- there is a "grace period" (delay) before the app requires a PIN code, after you've exited it.
By default it's 15 seconds, so if you close the app and then start creating your widget immediately after that -- no prompt.
This is in app settings -> Security, or you can do Menu -> Lock access on the app's main screen (account list).