I thought so too. But counterintuitively, security keys are treated the same as an already logged-in device. This means, even if you had a security key set-up,

I thought so too. But counterintuitively, security keys are treated the same as an already logged-in device. This means, even if you had a security key set-up, an attacker would still be able to change the iCloud password only with the knowledge of the device passcode. The attacker could even remove the security key after changing your Apple-ID password. You only get the extra security of the security key when you set up a new device or when you log in using a browser.