While Siri is turned off by default, it appears that Siri-while-locked might be turned on by default once Siri is enabled. I wouldn't enable it in the first place if I had seen it, so it was news to me when I saw that it was turned on when I went to change my passcode the other day.

If it's enabled in that manner by default and lets you bypass the lock screen, then there's a serious problem.