The iPhone "feature" referenced by the headline is that you can change the AppleID's password knowing only the phone's passcode; no need to enter old password,

The iPhone "feature" referenced by the headline is that you can change the AppleID's password knowing only the phone's passcode; no need to enter old password, no 2FA (technically having phone + passcode is 2FA according to Apple), nothing but the passcode. This presumably shields Apple from a torrent of support requests by forgetful users, but seems like a major security hole in the case that someone steals your phone. Once they change your AppleID pw they have EVERYTHING -- FindMy disabled, all other devices forced logged out, photos gone forever, etc. And once they enable "Recovery Key" on your iCloud account, Apple will never let you back in no matter what you do.