security command gives out passwords without prompting for the keychain password
I bumped into this same issue, and it seems its all about removing the default access when creating the new password, this is described on help of the command:

security add-generic-password -h


At the bottom you will see: 


  By default, the application which creates an item is trusted to access its data without warning.
  You can remove this default access by explicitly specifying an empty app pathname: -T ""
  If no keychain is specified, the password is added to the default keychain.


So essentially you create the password with the -T "" setting: 

security add-generic-password -a YOURUSER -s SERVICENAME -w YOURPASSWORD -T ""