In this case it is essential that the owner of the system take all possible precautions not to provide open access which is why there are disclaimers on every login banner on commercial servers. If the owner of the device has an option to enforce strict voice recognition but does not do so they are liable . It is like leaving your wifi unprotected and them having a random terrorist send death threat from your home wifi. You will be found negligent and hence culpable and you will not be able to prosecute anyone using your unsecured resources. Onus is on you to prove you did not leave your devices unprotected to allow burger king to incorporate it in their advertising. Google should allow incorporation of a passphrase along with strict voice recognition.