[vlovich123]

My guess is that it’s not necessarily about knowing that it’s you speaking. To satisfy that query, it has to let you make iCloud queries of your wife’s position with keys that aren’t secure (eg can be retrieved by hooking up to a computer with malware).

The other attack surface is that someone invokes Siri physically with the button on the phone. I think this does speak to the fact that Apple should probably add a security level which is “voice unlocked” which gives a transient key for Siri queries, which they can even tie together through the internal activity API so that only the daemons that are accessing such data in support of an actual validated query get to unlock the relevant data.