So "This is a very common attack on the Internet that we didn't do much to protect you against by default"?

It's a pain setting up two step authentication across a lot of services, but I guess iCloud is probably one that's worth the effort. Still I'd rather brute force was not an option.