This is pretty scary. I doubt there is a one size fits all solution, but it seems like a red flag that Find My iPhone can be disabled immediately after the Apple ID password is changed on that device. If there was a waiting period that wouldn’t be possible.

I don’t want it to be this easy to take control of my device. There should at least be an option to require the passcode and biometric authentication to do this.