Yes, they can't redeem any miles or PlusPoints from your account without first verifying it with the security questions. They also can't make new bookings with your saved profile/travelers/payment information without verifying the account either.