That is because your Apps and purchases are tied to your AppleID, and since your device had never been backed up to that computer before, iTunes needed to authenticate your AppleID to backup the contents (apps themselves are not part of a backup, but the list of installed apps to be re-installed on restore is, plus their folder locations and layout). But it would still backup to a file on the laptops hard drive, not to iCloud.
The activation steps are normal for a lot of things (if you used your fingerprint as a proxy with an app, say your banking app, you would also need to reset that app's setting as well after a restore of a backup). So while someone using your backup would not be able to sign in to WhatsApp as you, they may still be able to read any information that was stored locally in the WhatsApp app (I don't know for sure as I've never used WhatsApp, so don't know what it stores locally versus sync's in real time).
Unless you or he turned on encrypted backup and entered (twice) a password for it, then it would be an unencrypted backup. As I mentioned, that at least does not include any of your passwords, health data or other personal/sensitive data.