That seems like it should be enough protection. The goal of most thieves is to drain your bank account/Apple Pay. Changing your account password gives them more

That seems like it should be enough protection. The goal of most thieves is to drain your bank account/Apple Pay. Changing your account password gives them more time to take advantage of your account, but most of them aren't interested in doing a deep dive in your personal life, or care that you're locked out of your Apple account. A rate-limited 4-digit passcode gives you breathing room to login to your Apple account and report your phone as stolen.