A reddit user has discovered what appears to be a Siri-related bug that allows access to a locked iPhone's Cellular Data options without a passcode. 

As shown in the screenshot below, when Siri is asked to bring up Cellular Data settings (or if Cellular Data is on), an option to toggle the feature off appears on the lock screen, with no passcode required. When Siri is specifically asked to turn off Cellular Data, the personal assistant asks for a passcode first. 

Given that a passcode is required when asking Siri to disable Cellular Data, it seems that this is meant to be the default behavior and that it's not a setting meant to be controlled from a locked iPhone. 

It's questionable if this bug has any real impact, though, as there are other ways to disable cellular service on an iPhone that's been stolen, including turning on Airplane Mode from Control Center or simply turning the iPhone off. 

MacRumors tested the Siri command and found that it worked on iOS 9 and all versions of iOS 10, including the most recent iOS 10.3.3 beta. 

For iPhone owners worried about unauthorized access to their iPhones, both Siri and the Control Center can be disabled on the lock screen.

Source: macurumors