HTC M7 bypasses Avast PIN when this is done... not secure!!!

Hello,
Normally when I go to use my phone, I turn the screen on, swipe up, and do my unlock pattern. After it’s unlocked, to get to settings you have to enter the Avast PIN. This has worked great, however…
When I turn the screen on, I can swipe from the top of the screen down instead of swiping up. That brings up some basic convenient settings, such as brightness, WiFi, Bluetooth, etc, and more importantly, Settings (a cogwheel icon). These show up without unlocking my phone. When I go to settings WITHOUT unlocking my phone first, IT DOES NOT ASK FOR MY PIN, only my unlock pattern!!! This is a major issue for me. The pin to get into settings is the reason I use this app and I just noticed this.

I have an HTC One M7, Android version 5.0.2. I tried updating Avast, but the problem remains.