Siri Security flaw?

This might be old news, but I spent a confused hour or so trying to work out how a friend of mine had managed to post to my Facebook wall from my iPad despite me having set a password to unlock the device.

It turns out Siri is happy to help retrieve calendar events, post to Facebook, give out the names and addresses of my family and friends without the password ever being requested!

Doesn't seem all that secure to me... or am I missing something?