Here are some features and settings that you can allow changes for:
Passcode Changes: Prevent changes to your passcode
Account Changes: Prevent account changes in Accounts & Passwords
https://www.wsj.com/articles/stolen-iphone-passcode-security...
> • Enable additional protection. Some apps, such as Venmo, PayPal and Cash App, let you add a passcode. Just don’t use the same one as your iPhone.
> You can also set up a Screen Time passcode for yourself, then enable account restrictions to prevent an Apple ID password change, the way parents do with their kids’ devices. In Settings, go to Screen Time > Content & Privacy Restrictions, then toggle Content & Privacy Restrictions on. If you haven’t already set up Screen Time, you’ll need to choose a passcode. (Again, make it different from your iPhone’s.)
> Scroll down to the Allow Changes section, and where it says Account Changes, select Don’t Allow. Whenever you need to access your iCloud account settings, you’ll have to go to Screen Time and re-enable this.
- enable Screen Time
- set a Screen Time password, make it different than the iPhone password
- use Screen Time to disable making changes to your account
With this the attacker would not be able to go to the step of changing the account password without entering the different Screen Time password.
I wonder why this is not mentioned or recommended, seems kind of obvious. Sure it is a bit inconvenient but you probably very rarely make changes to your account.