If you look in the password and security menu in iCloud settings, there's an option to set a recovery key: "Using a recovery key increases the security of your account. When you create one, the only way to reset your password [emphasis mine] is by using another device [edit: emphasis mine] already signed in with your Apple ID or by entering your recovery key."

I can find no mention of this feature in the article. It would seem that it would mitigate the core problem described by preventing someone in possession of your phone and passcode (but not the recovery key) from taking over your iCloud account.