I guess the only consolation is that eventually the phone will logout, so the attack would have to be done soon after getting the phone?

Update: It's much worse than that. I just got a login notification on my ipad for my apple id. So I'm not signed in. But, I went to reset the password, and it said I can do it with a passcode since I'm signed in to icloud.

So icloud signin lasts far longer than apple ID signin for the app store.

This seems like a serious vulnerability. Makes me rethink having multiple idevices, or putting anything in icloud keychain. Any one of them gives access to everything.

I am not a security expert though, so take this with a grain of salt.