As far as I am aware this is intentional behaviour, with the ability to opt-out.
These guys should turn the "Allow access to Siri when locked with a passcode" option to off.
These guys should turn the "Allow access to Siri when locked with a passcode" option to off.
Being able to trigger it and make requests without looking at my phone is one of the key reasons I use it.
It's a convenience / security trade-off that is under the user's control in Settings.