Well, it can read your schedule, tell you your location and then there is the homekit stuff. It could potentially disable certain security features you might have installed at your house, it could possible perform a very expensive modification to your HVAC configuration, in an extreme case that could maybe be fatal (disable heating in the winter at an older person's home or something like that.) It can also read your messages which are used for MFA in some situations. My wife and I have our accounts hooked together and I can ask Siri where she is and it uses find my friends, it can also kick off find my iPhone which shows my wife's presumed location on a map.

I think it can do Apple Pay actions too.

Degrees of dangerous. I don't have a homepod but presumably it couldn't do anything with Apple pay or your messages. Having Alexa or Siri control home automation stuff seems like something you might want to think about a little, leaving the lights on all day and burning some energy is a very different thing than re-configuring your HVAC or a security camera.

At least on your phone, almost everything it can do that'd be 'dangerous' required your device to be unlocked or has a confirmation button (or both). Examples would be unlocking a door, opening your garage, sending an email/text message, sending Apple Pay Cash, etc.

Send emails is one example. I don't use Siri, but apparently it can send emails including to multiple recipients. The "danger" is only limited by your imagination in the scenario where a malicious stranger has access to your email client.

Call or text an expensive pay line, read the codes sent in confirmation text messages or mails. Open a web page that has an exploit on it.