This is the default behavior if you don't turn this stuff on. They store your account recovery key in an escrow device.

The main problem is that walking into an apple store with a government-issued warrant works just as well as walking in with a government-issued ID.