Contacts and photos can be viewed iOS with some effort, even if the iPhone is locked.
As in the past, an active Siri is the gateway when the iPhone is locked. Combined with an external call, some Siri commands and taps in the right place you can get access to data on an iPhone that should not be accessible. The YouTuber videosdebarraquito found this out with a lot of time.
This is not necessarily practical for everyday attacks, but it shows that there is always somehow a possibility to bypass possible locks. Currently the problem can be solved easily: Switch off Siri in locked state (Settings > Touch/Face ID).
(via)
