Yeah, I thought the same. XBL purchases come out of your MSPoints wallet, which is (logically enough) stored in XBL, not the console - you can purchase stuff through the xbox.com website too, and stuff gets downloaded when you turn the console on again. Credit card info is stored on XBL too, as far as I can boundlessly speculate. Wouldn't make much sense to store it on the console, especially since the XBL account is not tied to a specific console.
However, as far as I can tell you can have multiple 360s logged in at the same time, and the console stores authorisation cookies, not passwords; you can change the Windows Live account password and the console will still happily log you on. You can change your privacy settings to only allow your One Holy Console(tm) in without passwords. Still, theoretically, you could (somehow) let your hard drive slip to someone else, thus allowing them to log in as you, and have someone charging stuff for your credit card, but all those points would go to your account anyway. All the more reason to set the password asking on.