I never have a payment method tied to my account and I only buy ms points when I need them.
:>

Even if someone was to hijack my account they wouldn't be able to do much but spam my friends(even though I spam them anyways).