It's true. With the phone locked down you can still hold down the home key, and voice dial someone in your contacts list. Some will consider this a feature, and others a bug. If I wanted to make a quick call, it seems it would be nice to bypass the log in. If a thief had your iPhone, he'd have to know the name of someone in your contacts to call them, or just try a lot of guesses.
Then there is the matter of why a criminal would want to call someone on your contact list. "Hi Bob, I just stole this iPhone. Pretty neat, huh?"
If this issue does bother you, Apple has thoughtfully given you the ability to turn voice dialing off, and when you try it with the phone locked the computer voice dutifully warns you that voice dialing is non-functional.
You can't, by the way, turn off iPod voice control. So anyone could pick up your locked iPhone and say "play songs by Tiny Tim", wearing down your battery and offending everyone around them.
Thanks to Mike for pointing this out, but I don't think it's a big issue. Have I missed something? Weigh in with your thoughts.