Every now and then I decide to throw one of Apple's betas on one of my devices. This time I've been running the iPadOS beta on my iPad Air Generation 3 since the public preview started for 13.0. I like a lot of the features (ok, mostly dark mode) but as is the case with most of the betas there have been a few bumps along the way. The most notable is the behavior of the Home Control privacy setting that I noted back in the iOS 11.0 and iOS 11.2 releases.
I don't have any HomeKit devices still (and don't ever plan on having any) so I'm not 100% certain that this is a security risk, however it seems that given the behavior that if you had someone's phone and knew they had HomeKit things you could simply reboot their phone and then access the Home app from the lock screen. This seems to not be ideal given the ever increasing fleet of locks and cameras and alarm systems that can hook into HomeKit. That being said, being able to fiddle with the lights in a stranger's home seems pretty bad, even if it doesn't strictly speaking give you unauthorized access. I'd love to hear one way or another if someone can test and verify this. If so I'd urge you to send Apple feedback using the Feedback app in the beta.
Maybe they'll finally fix this because I'm pretty sure that in any case settings changing upon reboot is not exactly intended behavior.