It is double-edged sword. Adds new attack vector to compromise the whole phone. Is the user data encrypted when the maintenance mode is on? Can thiefs access it and make phone usable?

The user partition is encrypted by default, so a Maintenance Mode user has no access to user data. Maintenance Mode can only be enabled if the device is unlocked, so a thief could only enable it if they have your device password or they grab your device while it's unlocked; obviously that's a more general attack vector. The device can still be remotely located, locked or erased while in Maintenance Mode.

>Is the user data encrypted when the maintenance mode is on?

Yes, the primary device user data remains encrypted. The temporary user functions in a sandboxed state.

>Can thiefs access it and make phone usable?

The expected functionality prohibits access to the primary user data. Even if they were able to break from the sandboxed space somehow, the primary user data maintains an encrypted state.

> The expected functionality prohibits access to the primary user data. Even if they were able to break from the sandboxed space somehow, the primary user data maintains an encrypted state

That was not my point.. just thinking if that would add resell value for the phone. Currently it is zero for iPhones.

Lots of people seem to be misunderstanding this post. Apple is not asking for the posters password, they are asking for the poster to disable a function, which can be disabled online and offered a device to do this. They were not offering the device to capture the password in order to perform maintenance.

Poster is concerned about entering password on a device used by many. Poster could go home log on to iCloud on a device they own and disable Find my from there. No passcodes handed over. No access to device data, remains encrypted.

I think that’s because it seems like the OP misunderstood what was being asked of them. I think you’re 100% right here (having gone through this exact process and choosing, exactly as stated, to remove Activation Lock/Find My via my personal machine rather than a store machine) but OP seems to think they were asking for his phone passcode. That doesn’t make sense to me but it looks like that’s what he’s stating - phone passcode, not iCloud login - and I think that’s causing the misunderstanding.

Lots of people seem to be misunderstanding this post. Apple is not asking for the posters password, they are asking for the poster to disable a function, which can be disable online and offered a device to do this. They were not offering the device to capture the password.

Poster is concerned about entering password on a device used by many. Poster could go home log on to iCloud on a device they own and disable Find my from there. No passcodes handed over. No access to device data.