OK, I just tried setting it up. Here's the problem. You can certainly set the recovery key, but you can easily create a new one just with the phone passcode. So

OK, I just tried setting it up. Here's the problem. You can certainly set the recovery key, but you can easily create a new one just with the phone passcode. So if your passcode is compromised, your iCloud account is basically gone.