Yes, I can now confirm it works on a real phone. Even though it has no requestSiriAuthorization, or Siri privacy description plist entry which I thought was really strange at first - but I think I understand a bit better now.
This app doesn't actually let you say something like "Order 1 Tomato Soup using Soup Chef" to Siri, which would then proceed making the order using Siri Intent UI, like you can do with a SiriKit app that, for example, sends messages (one of the pre-approved SiriKit intent domains). This app only lets you manually save a shortcut (and it also automatically donates a shortcut when you make an order) for an action you've performed. So really, considering that user is 100% in charge of creating or using these shortcuts, there's no need for some kind of prior Siri authorization, I guess.
I'm not sure anymore if it's really even possible to create an app in iOS12 that would do the "Order 1 Tomato Soup using Soup Chef" custom intent parsing, without a prior shortcut creation? Watching Craig's presentation of the Tile app, and other quick examples he gave, they all seem to behave a lot like the Soup Chef app - you only record a voice shortcut to an already established action, and there's no custom intent parsing. This is something I'm very ineterested in, as I could apply it to my apps, but even just shortcuts creation alone is very good to have, to be honest. I can implement that in my apps in many useful ways.