The security model here is different than usual. The goal of the challenge is to authenticate you to them - in case they are calling a landline, or a left-at-ho

The security model here is different than usual. The goal of the challenge is to authenticate you to them - in case they are calling a landline, or a left-at-home mobile phone that the burglar is now answering. So this actually makes sense. If they call, you say you word, then they can't authenticate themselves to you, it seems like you must then change your word. For active man-in-the-middle, I don't think this protocol is designed to protect against that.