When they file a patent like this, does it necessitate that they have a working technology for this, or ... is it just an idea?

If the latter, what's stopping someone like me from patenting 'analyzing unique brainwave signatures through non-invasive EEG technology to authenticate individuals' ... which is something that _will_ happen, just a question of when.