Siri active automatically

Only the HomePod has voice recognition the determines the user making the request. On your iPhone, it requires unlocking the device before any personal information is revealed, where on the HomePod, since there is no physical verification it has to rely on the users voice. Anyone one can make a request such as asking the time or playing a song, but if it involves personal information such as your messages, phone calls or your appointments, verification will be required. On the iPhone it is done with FaceID/Passcode and on the HomePod it is done with voice recognition. It has always been that way and nothing to do with the recent update.

Many people think that is how it worked before, but here is a post from 3 years ago asking the same question.

Siri responds to anyone's voice, includin… - Apple Community

tharsighan wrote:

A $150 Samsung phone can recognize only the owner’s voice with “Hey Bixby”but a $1200 iPhone lacks this feature. I believe this is a software issue, not a hardware limitation.

Bixby has had is own issues with voice recognition responding to another voice and providing personal information. You don't need to take my word for it, that has been a known problem with complaints about it everywhere on the internet.

For Apple, that poor security is not good enough and for any personal information, it will require FaceID/Touch ID or Passcode for positive identification. You can be sure if someone else asks your iPhone what your number is that they won't get it because it will require your verification. Using Bixby, you can only hope that your phone won't provide your phone number when asked by another person. Sometimes it will and sometimes it won't. The accuracy of voice recognition is nowhere near what is found using a fingerprint sensor or face identification. Maybe someday the technology will be there, but currently it is not for what is needed when it comes to your security.

Why did Apple include this feature in the iPhone 11 but not in the 15 Pro Max?

It was never a feature. When setting up Siri, it does go through a training process for Siri detection, but it is in no way a positive identification of your voice when it comes to your personal information. It is primarily done to reduce false activations of Siri, not for positive identification. If it was used for positive identification, you could ask Siri what your phone number is and it would respond and that has never been possible unless your phone has already been unlocked by another method.