What security measures are in place?
You can lockout the bridge functions in a Runabout, as seen in "The Jem'Hadar", however, those security measures aren't always in place, as seen in "Paradise.", which almost exactly describes the scenario you asked about.
Sisko and O'Brien beam down to a planet leaving the Runabout in orbit unmanned. The Runabout is essentially "hijacked" and sent off to be destroyed in the DS9 episode ) by an anti-technology hippie, who is on the planet.
However, when Sisko attempts to contact their runabout, he finds it missing. Alixus emerges and admits that she destroyed the runabout and even helped invent the device that created the duonetic field in the first place. - Memory-Alpha
Sisko expected his runabout to patiently be waiting for him in orbit. However, Alixus had contacted the Runabout and either beamed aboard and/or programmed it to fly into a star. She wasn't Starfleet, so she shouldn't have had access, but she clearly did.
Further investigation reveals that it has been exposed to intense gamma radiation resulting from a close proximity to Orellius Minor, a nearby star. Dax hypothesizes that someone tried to destroy the Rio Grande by flying it into the star, for if the trajectory were slightly off, the gravity of the star could have deflected the ship and sent it in a new direction.
Dax and Kira eventually backtrack the Runabout's route to the planet Sisko and O'Brien are "trapped" on.
Star Trek as a whole has a history of people being able to use vessels without authorization (most notably those Klingon Birds-of-Prey), although we do see some security actions being taken.
The Defiant (in "Defiant") has a bridge lockout code, which must be entered before the ship's systems can be accessed.
In First Contact when Picard realizes the Borq are on his ship he has Data lockout the main computer so that none of the primary functions can be used.
Riker manages to lockout the computer in TNG "Rascals" while Ferengi are attempting to steal the ship. - thanks Politank-Z
Jake and Nog locked out of the Runabout in "The Jem'Hadar" - thanks Politank-Z
Lack of Security Examples:
The aforementioned episode "Paradise."
Daimon Bok is able to pilot the abandoned starship Stargazer (TNG "The Battle")
Khan is his people are able to commandeer the Reliant in Wraith of Khan.
Kirk (ST3: Search For Spock), Dukat (DS9 "Return to Grace"), Augments (ENT "Borderland"), and Ferengi (TNG "Rascals") easily commandeer Birds-of-Prey. All they had to do was get on the ship.
Archer and his crew are able to capture and eventually fly a Suliban Cell Ship (ENT "Broken Bow")