> Settings > Security > Device Administrators.
Yes! This is it! Thanks, Yochana.
For those who don't know, "Device administrators" (or Phone Administrators, on my S5) are apps that are allowed to manage or even erase the phone, or transmit money. Those MUST have a password for obvious reasons - but it's hidden in a stupidly obscure place. (And why isn't it called Device Administrator Apps??)
In my case the problem started when I activated Android Pay and Device Manager (which can remotely erase the phone, in addition to doing "find my phone").
To me this makes clear how, at the moment, the iPhone has a HUGE security advantage because its fingerprint reader really, really works, and the Android one (or at least Samsung's) is totally unusable. When I turn this off, I lose payment and Find My Phone. Oops.
Well, it's fixed, anyway.