Welcome to the community.
Here’s why the CVV code isn’t requested again by Monzo -
But I take your point about being given the option. That’s a very common security measure, that’s put in place for different types of payments so Monzo will have made a conscious decision not to deploy it.
You should of course protect your phone with a pin. If you’re an iOS user, you can also require Touch Id verification in order to open the Monzo app.
At the end of the day, if someone got hold of your phone, the worse they can do is top up your own account. There’s not much incentive for someone who’s stolen your phone to do that.
Monzo does monitor how often an issue like the one that you’re anticipating occurs, if it happens too often, you can be sure that they’ll enable the option.