The controller pin is an output as it has to drive the PNP's input (the PNP's base).
I think you're confused because the current that is needed to activate the PNP flows into the controller. That doesn't make it an input. It is still an output as it drives (controls) the circuit connected to it.
Input <=> output indicates what (controller) controls what (PNP), not the direction of current.
R1 is needed to make sure the PNP is off when:
- the controller hasn't initialized the pin as an output yet, at startup most microcontrollers define IO pins as unconnected. That would mean the state of the PNP will be unclear. R1 fixes that, it switches the PNP off.
- the controller uses an "open collector" or "open drain" output which can only "pull down" the output. Then the controller cannot actively switch off the PNP as it can only pull current and not connect the output to VDD. R1 fixes that, when the output is off R1 pulls the base of the PNP up to VDD so that the PNP is off.