I have considered this for a while now and now I believe the "security" for Android is all over the place.
1)You should not be able to call or message someone while a phone is locked.
Having a paired Bluetooth device is a form of user identification but really is a fairly weak identifier.
I could steal a paired Bluetooth device with the handset then make calls to anyone I like without authenticating who I am.
It appears Android 7.1.1 prevents use of Google Voice from a locked phone on the phone itself but allows some access if a paired Bluetooth device initiates the Google voice.
Apple by default allows Siri from handset while the phone is locked. It then allows from the phone calling and messaging while locked.
Apple allows the user to opt out / disable Siri from lock screen, but this would prevent Siri use in say a car while it is impossible / illegal for the user to unlock the device.
To me this appears Apple has a brand new "bypass the lock screen" problem introduced by default Siri settings.
2)Google App has a weird "security" measure that prevents a call connecting via Bluetooth but allows via speaker phone if phone is locked.
This Bluetooth restriction makes no sense.
Google App allows the call to connect, a Bluetooth device could have initiated this call via other methods to overcome this "security" and the Bluetooth device can switch the audio to Bluetooth once the call is connected anyway.
3)A paired untrusted Bluetooth device should not be able to initiate a phone call from its contacts, dialpad or other methods..
Current Android 7.1.1 entirely / incorrectly / insecurely allows these calls.
4)Android has "Smart Lock" where I can add my Kenwood DDX9016DABS as a trusted device which allows my phone to be automatically unlocked if connected.
This is the answer to the above security problems. Allow a user to specify paired devices to explicitly trust regardless of lock state.
This does "work" while my headunit is connected I no longer need to enter pattern/finger/voice or face etc to unlock, instead only an insecure swipe is required to unlock.
However this does not work with Google Voice dialing.
Google Voice considers the phone still locked until after the insecure swipe. This is the same if insecure swipe lock method was the lock type for the phone.
Conclusion:
-Android 7.1.1 has a security flaw that it allows unauthorized phone calls and use of Google Voice while a phone is locked if initiated by a paired Bluetooth device.
-Android 7.1.1 Smart Lock use should be required for a paired Bluetooth device to use the phone while locked.
-Google App since 6.16.25.21.arm64 has a bug where it connects phone calls to speaker phone if phone is locked. This bug may have been introduced while attempting to prevent unauthorized phone calls while locked.
-Google App / Android OS while phone is locked should only allow access to "Ok Google" unlock authentication.
-Google App / Android OS if initiated by a paired and trusted Bluetooth device should allow all functions.
