Isn't this considered a security flaw?

Even if you don’t put in the passcode, you get full control of the clock if you have a clock widget on the lockscreen. And it works even if it doesn't have access when locked. Or is there a way to stop this?