Complying with the user preferences would be a good one.
My elderly dad doesn't use his iPhone for anything sensitive and it is not even password protected. If that phone gets lost I will replace it. He doesn't need his apple ID to be "protected" by Apple this way.
It’s a bit of a bind though isn’t it? If they loosen their rules, someone will exploit it. Where is the balance?