Hi John. We were not able to reproduce such behavior.
Generally, tapping notification cannot bypass security of the phone. You always have to unlock the phone in such cases. As CraigB mantioned, phone was probably unlocked by Face Recognition or Iris Scanner while you tapped on the notification.
If you want to verify that, try to disable Face recognition and Iris Scanner, set up e.g. Pattern as a method of unlocking and try to tap on a notification while phone is locked.
Hope it helps.
Tomas