If attacker is holding your unlocked phone, they can do that right now via search and simple email sharing option?

yes of course but simply clicking a shared shortcut (siri agent) could be very harmful.