After the iCloud celebrity "hacking" scandals they added phone-based 2FA and now have "your iOS device can be trusted": https://support.apple.com/en-us/HT20491

After the iCloud celebrity "hacking" scandals they added phone-based 2FA and now have "your iOS device can be trusted": https://support.apple.com/en-us/HT204915 https://support.apple.com/en-us/HT204915 though I don't know if the security question reset path is closed. There was a small flare up earlier this year about people hijacking cell phone numbers, which then of course let's you take over all sorts of accounts since you can defeat the (relatively) poor security of SMS-based OTP.