Three-way
The passcode comes first.
Before the assistant will help on the call, it asks for your passcode. Press it on the keypad, or say the digits.
The keypad is the sure way. Saying the digits works too. Oh counts as zero. One, two, and three count as those digits.
A wrong try is rejected. It asks again. Three wrong tries and it hangs up, and you get an alert.
The digits are not in the alert, the transcript, or this page. MyPhone keeps a hash, never the digits.
If it only catches part of what you said, it asks you to say the whole passcode, one digit at a time.