Apple forces 2FA enrollment now. And someone who steals the phone and asks for the pin now has access to icloud reset.