Seems like there are vanishingly few security measures which prevent the held at gunpoint scenario but still allow the user to do things.
This is essentially the famous xkcd "5 dollar wrench" problem https://xkcd.com/538/
At this point I will just stop commenting on this post as it seems like either Apple already fixed this or some of the most critical information has been omitted by the author. So we are just guessing and raging for no reason.
Unfortunately I don't have an iPhone to check, but another comment [1] suggests that this may happen if you physically change SIMs. My brother said they didn't ask for his iCloud password, which makes sense: if they had the password then they wouldn't have needed the phishing step afterwards.