If this is true it is an impressive security debacle for a company like Apple, "allow siri access while the iPhone is locked" should clearly be off by default, and the user should be alerted about the potential dangers when deciding to turn it on.
My expectation is that my phone is reasonably secure from co-workers when I leave it on my desk for fifteen minutes at a time. And that if stolen, I have enough time to remote-wipe it before the passcode is bypassed.
You have some limited access to features while Siri is on, only if the allow with passcode option is enabled. You do not have full run of the entire phone, nor are you able to bypass the lock screen.