> How is removing an secondary, 3rd party email from my iCloud account take 30 days? Many services do this. It prevents a bad actor from locking you out of you

> How is removing an secondary, 3rd party email from my iCloud account take 30 days? Many services do this. It prevents a bad actor from locking you out of your account by removing all your recovery methods. With the grace period, you’re still able to recover your iCloud account even if it gets hacked. > What if it were compromised? This can and does happen, especially when phone numbers are used for recovery. I avoid phone-based recovery wherever possible for this exact reason. I can control an email account, but I can’t control someone sim-swapping me. I don’t have the data, but it seems that a direct attack on the account is more common than an attack on the recovery method. So a tradeoff is made and a grace period applied to recovery methods.