Widget subscription is completely optional and not required to use music, so unsubscription should not clear those settings.
The more reasonable thing would be deactivation, however, the device itself is not involved in the deactivation process, and once that's done, the server can no longer communicate with the device. We don't keep *any* music settings, including credentials, on the site, so there's nothing there to clear upon deactivation.
The only way to address this would be for the Control Panel to clear music credentials when it finds itself deactivated upon the next attempt to authenticate - however, since Pandora is actually a plugin module, the Control Panel theoretically has no knowledge of how and where Pandora stores the credentials. In practice, however, since the music subsystem is pretty static at this point, it might make sense to hard code specific support for clearing of Pandora credentials under these circumstances. The downside is that if you had a temporary network disruption that somehow caused the CP to think the device is not activated, then the credentials might get incorrectly deleted.
In general, though, someone planning on passing their device onto other people should do a factory reset, just as they should when disposing of a phone.