I think it's different to have privacy and need to have password protection to get privacy. Preferably you'd respect each other's privacy enough not to need password protection.
Still should have it, it's just sensible data safety. Someone might steal it and shit
It's a fairly common feature. Message comes in, lights up the screen, you can see which app the notification is from, who sent the message and what they wrote. Usually there's privacy options to hide the message content or even the sender.
Might've just seen them light up the screen. I'm constantly seeing the messages my wife gets because they light up her screen and the automatic reaction (at least from me) before realizing is to glance at the screen.
Though from options you can hide the sender and content and even disable the screen from lighting up.