I'd say real MFA, so buy an iPhone and get at least to tokens for free.

Immediately deliver a software update that remedies the various steps in the attack.

The victims loose all iCloud data including all photos of sometimes ten years or more. There needs to be another layer to protect backups.

Have two pins like with the SIM cards with pin and puk. Should actually be something that apple should have thought of from the getgo.

not letting banking or TOPT apps work or showing validation sms codes without biometric unlocking even if you type in the password or pin.

I wouldn't mind it a bit if biometric face id triggers every time I need to read a validation sms or use a security sensitive app, even if the phone is unlocked.

time lock important changes like biometric info or anything that may result in an account takeover.

Add a time delay to the password reset feature, and notify all other devices that a password reset was attempted.

Not allow resetting from a device only with the pin?

Also don’t allow the pin for some operations (or let you disable this). E.g. for viewing passwords or other sensitive operations besides login, it’d be safer for me to not allow pin access and only Face ID.

Don’t allow PIN as valid login for for password managers or apple id changing?