In theory anyone in possession of the band could get in to your room, use your FPs , get into a park, and buy stuff.
In reality, it's hard. Assuming you don't put your pin code and room number on the band.
As soon as the band is reported they can deactivate it, which stops it. And yes they will replace it, it's not unlimited (I know APs get 1 and 1 replacement per year), and it will be replaced with a grey unpersonalized band. As far as if you are staying on property, and using it for your room key, I don't know how many times they will replace it.