Hi Kirk,
Control Center can be setup to be brought up on a locked screen. No problem there. It is easier to demonstrate that on devices without Face ID, such as iPhone 7 for example, where Face ID does not have the opportunity to unlock your screen before you even get to swiping.
Regardless, OP is flat out wrong. His/her theory that has been posted does not work and there is no such flaw. The OP talks about devices with Face ID. Well, an iPhone with Face ID will unlock the iPhone the second it is picked up and looked at by its owner. The iPhone is already unlocked before even the control center is pulled up. OP is wrong.
Axel F.