> A lot (most?) people’s Apple Account name is actually their main email address (e.g. Gmail), so they would still control their email address even if their App

> A lot (most?) people’s Apple Account name is actually their main email address (e.g. Gmail), so they would still control their email address even if their Apple Account was compromised. But this is an example of not putting all your eggs in one basket. An all-in Apple customer is using Apple as their main email. > You can still recover your Apple Account and iCloud Keychain without any devices This assumes that you remember your password, and that the attacker has not changed your password, and that the account has not been permanently disabled for abuse. > Your passkeys stored in iCloud Keychain are still protected even if your Apple Account has been compromised. "Protected" means someone needs more than just the iCloud account to get access to them, not that you can re-download them if you lose access to your iCloud account. It also depends on how your account was compromised. For example, if a thief observes you entering your unlock code and then steals your phone, they have the device they need to access all your passwords too.