K8y "At rest" generally means "stored somewhere but not in memory". If the information is stored encrypted (in files or in a database), then "at rest" generally means that the encryption key is not in memory. For example, if "End session" is used on a secondary profile on GrapheneOS, all apps running in the profile are stopped and the profile's file-encryption key is deleted from memory.
A messaging app that supports end-to-end encryption might store received messages unencrypted in the app's private storage. Or it might store the messages in an encrypted database but keep the encryption key in memory when the app is running.
This is relevant because some users wish to keep messaging apps running constantly so they can receive and instantly display messages. If the app protects the encrypted messages with a PIN or password, but the app is constantly running and the encryption key is constantly in memory and the app is exploited, the exploiter can extract the message contents despite the PIN/password protection.
PIN/password protection done by an app launcher probably doesn't help against a remote exploit, and PIN/password protection on an app's database probably doesn't help against a remote exploit if the app is constantly running. So, overall, PIN/password protection isn't very helpful against remote exploits.