So on my dashboard I have an HSM status icon (which if I enter and change modes does prompt for PIN), but I also have 4 virtual buttons that are set to arm home, arm away, disarm and cancel alerts. Can I add some code to have my dashboard ask for the PIN if somebody hit disarm?
Natively, no; you can only PIN-protect specific Dashboard features, HSM being one, but not arbitrary tiles.
With some creativity, maybe. I haven't tried this, but there is similar logic that works for lock code management even though that is not natively supported by Dashboard, and the general idea would be something like that. Maybe:
Create a hub variable in Settings > Hub Variable called whatever you want, of type String, and with some default value, maybe Tap to Disarm.
Authorize this variable for use on this particular Dashboard (Apps > Hubitat Dashboard > (your dashboard) > Choose variables) and add a Variable (not device) tile with this variable selected.
Create a new Rule Machine/Rule 5.1 rule:
use a trigger capability of "Variable" and event of "changed" for the hub variable you created in step 1.
create actions similar to:
IF (hub variable = '1234') THEN
Disarm HSM
END-IF
Set hub variable to "Tap to Disarm"
This isn't exactly like pressing a button and making it happen, but the idea is that the rule will do this work for you if you tap the tile, put in the new value of the variable equal to the "PIN" you want to use (the string "1234" in my example above, but this can be whatever you want), disarm HSM if the string matches, then reset the value. I'm using "Tap to Disarm" as a placeholder here so that's what will be most prominently displayed on Dashboard most of the time -- and that's the reason I'm using string instead of number for the variable type, even though the latter sounds more intuitive.
I also haven't tested this so might be forgetting something you need for your use case (though I can't think of anything!), and you can, of course, tweak this general idea as you see fit if you think it otherwise sounds like it would work for you.
You could make a separate dashboard that is Pin Protected that has two items on it: 1- the disarm button from your first dashboard, and 2 - a shortcut back to the original dashboard.
Then replace the disarm button on the first dashboard with a shortcut to the dashboard you just made.
When they hit the shortcut, they will be required to input the pin to open the dashboard so they can hit the button. Then just hit the shortcut to go back to the original dashboard.