If you use Google Assistant, you could set up your arduino as a lock that requires a passcode. Then you could leave it off of your sitemap so that it’s only accessible by voice. I’m not sure if the same is possible with Alexa.
The way I look at it, is someone going to go to the trouble of hacking into your network and finding your sitemap so that they can unlock your door and walk through the front entrance, or are are they just going to break your window?
Personally, I’d be more concerned about the arduino triggering for some unknown reason (not necessarily related to openHAB) and opening your door while you’re away.