In the summary you skipped few points: 1) First article mentions: "I have a couple of theories though. I set up Find My with an Apple ID that I don’t remember"

In the summary you skipped few points: 1) First article mentions: "I have a couple of theories though. I set up Find My with an Apple ID that I don’t remember" 2) Second article mentions, that he attempted to report this as a vulnerability bug bounty program and disappointed that it wasn't considered a vulnerability. 3) The whole premise of "an email to Tim Cook" looks like a clickbait. By the point when he sent this email, his previous blog post already reached the top of Hacker News. There is no indication that Tim Cook was involved. The email was processed by staff in Japan. The combination of these 3 facts make the whole story look very fishy. Given that author does not remember if he configured "Find My" at all, consequent "we don't own our devices anymore" sounds like populism and appeal to sentiment rather than a logically valid inference.