1. Allowing new devices to buy stuff without two-factor auth is weak sauce. 2. The larger meta-point that when we rely on the cloud in a big way, it hurts when we are locked out.
The possibility I hinted at is that someone just "pretends" they have an iPhone and communicate with the Apple server directly. I don't know how their algoritm works, but it may be the case that they only need an Apple id and some secret key that is stored on the device. In that case asking the user for their password is just a way to protect the user when they lose their actual device. That would be pretty insecure from Apple's side. They should at least use the password to generate a key pair. (This doesn't necessarily require anyone to steal secret keys from Apple I just realize)
I completely agree with your second more general point. See also my comment on the Paypal thread: http://news.ycombinator.com/item?id=2880194