security command gives out passwords without prompting for the keychain password

I bumped into this same issue, and it seems its all about removing the default access when creating the new password, this is described on help of the command:

security add-generic-password -h

At the bottom you will see:

By default, the application which creates an item is trusted to access its data without warning. You can remove this default access by explicitly specifying an empty app pathname: -T "" If no keychain is specified, the password is added to the default keychain.

So essentially you create the password with the -T "" setting:

security add-generic-password -a YOURUSER -s SERVICENAME -w YOURPASSWORD -T ""

First try to unlock the keychain with security unlock-keychain -p :the_keychain_password: :path_to_keychain: