In iOS 12.1, contacts can be viewed with a little effort, even if the iPhone is actually locked.
Jose Rodriguez, who likes to search for security holes in the iOS system, has captured this fact in a video:
The contacts are accessible when you start a call via Siri, then switch to FaceTime and want to add another user. Of course this is logical on the one hand, but on the other hand the iPhone should be unlocked before private information is released.
As usual, an activated Siri in locked state is the gateway. So if you want to be on the safe side, you can only use Siri if the iPhone is unlocked.
