In a Star Trek TNG episode called "Brothers" Data takes over the ship by throwing his voice and pretending to be Captain Picard. The computer is aware of where Picard actually is on the ship due to its internal sensors, so why would it allow someone who it knows to not be Picard access simply by throwing their voice?
I'm not aware of in-Universe reason, but being a software developer, I can think of 2 off the top of my head:
Whoever programmed Enterprise's computer didn't think to check location in voice identification code. I mean, how many userid/password checking code blocks out there today actually check IP addresses or GPS info? How many biometric ID programs in existence are smart enough to cross-check location info?
Remember, since it's not an AI, the Enterprise's computer is only as smart as the guy(s) who programmed it.
Having yesterday turned off "location awareness" in the web browser on my Android smartphone, I can easily see someone making the above checking optional (for example for when the voice control happens from outside the ship, e.g. via communicator), and it was either turned off, or Data turned it off.
The computer is mostly likely not programmed to use location information when using voice print identification. This could be intentional, or it could just be an oversight. Consider, for example, that there may be a case where a high-ranking officer needs to issue a command to a ship from a remote location, via a communicator or holovid for example. Or, as mentioned earlier, perhaps the ship was simply never programmed to make that correlation because no one considered it. (This is the in-universe equivalent of the real answer, namely, the writers just didn't think about it.)
Note that Data does not lock the crew out by "turning on" this location awareness of a given individual when issuing commands -- he does not mandate that "the person must be on the bridge when they issue a command". He turns off any voice command activation from anywhere else in the ship -- he mandates that in effect "the command must be received by the audio sensors on the bridge". In theory, if he had issued a command in Picard's voice from the bridge, while Picard himself was elsewhere, the computer should still have accepted it.
Why didn't the computer realize Picard was elsewhere
- If com badges are used to track people, they're clearly not a reliable identification system and it would be a bad idea for the computer to stop accepting commands from Picard simply because his badge were stolen or damaged).
- Data is not the average attacker. He's able to manipulate the Enterprise's computers almost at will, circumventing security mechanisms and setting up ones of his own. It's thus possible that he simply disabled any such sanity checks, even if they existed (i.e. if the computer had used biometric-based location tracking, e.g. heart rhythm/gait patterns to identify crew locations).
Why TOS-era computers could identify faked voices but not the Enterprise-D
- Security is an arms race, often biased towards attackers rather than defenders. At various times, one side will outpace the other, and it's possible that TOS era biometric security was stronger than voice reproduction technology (or at least in that specific instance against the Eminar VII voice duplicator).
Data is not your average robot. Doctor Noonian Soong was quite adept and very meticulous when it comes to replicating biological/humanoid characteristics in his androids, to the point that at least one of his androids has lived for decades amongst humans undetected (and without her even knowing it herself). Data is built with hair that grows, simulated breathing, a life-like blinking algorithm, an aging program, a circulatory system, the ability to dream and get drunk, and other human-like anatomic details. It's therefore plausible that his speech synthesizer has the ability to fool most biometric systems.
Also remember, Data's an exceptionally intelligent and resourceful person, so using his wide base of scientific knowledge, his superhuman analytic abilities and attention to detail, and auditory processors and sensors that likely rival the ship's own voice analyzer, he would probably be able to precisely analyze Picard's voice to the same level of detail as the computer and deliver a reproduction that was just authentic enough to pass muster.
The internal tracking of crew is somewhat irregular in the show. The computer seems to primarily use the combadges for automatic location tracking. It only reports the location of people by specifically scanning them when ordered to do so. Since combadges are regularly lost/destroyed the computer apparently just accepts voiceprint identification for most functions. The computer CAN require hand-print ID such as when Picard and Riker first initiated the self-destruct system (S2E02 "Where Silence Has Lease") but apparently that's too much trouble for everyday use. Data is probably the only being that could bypass security in this way due to his unique abilities.
Speculative answer: Data records all conversations within his hearing. That way when he assumes the "voice" of another character it is simply him repeating spoken dialogue from that person in that person's exact voice. The computer would thus be "hearing" that person's voice and presume that it was the individual question issuing the commands.
Since it is an exact digital reproduction of the person's voice (in that case) Captain Picard, there would be no reason for the computer not to presume that he was not the individual issuing the order.