> and you can sometimes phish the Apple ID credentials from the victim, which is why stealing those devices is still profitable enough.

Yep, I always see "is this text legit?" posts with clear phishing URLs in iOS help groups on Facebook, posted by people who had their iPhones stolen and think it's Apple Support attempting to get it back.