The whole system isn't an LLM. At the point they are asking for confirmation, they've already parsed the required information and handed it off to normal code. It's not going to change again.

Ultimately, an LLM only has the capability to take a string as input and output another string. Any other functionality (Uber, search, travel, etc) has to be manually programmed in via APIs. For the foreseeable future, a fixed set of actions is the only way to do this reliably and is what this device does so talking about the second case of an LLM run amok is a moot point.